Browse / inDrive

inDrive

See its reports on the map

Attack surface: 2,406 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to inDrive

• Cross-site Scripting6
• Information Disclosure3
• Business Logic2
• Access Control2
• SQL Injection1
• Server-Side Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Change phone number OTP flaw leads to any phone number takeoverBusiness Logic Errors · critical
   $2,000241 votes
2. Blind SQL injection on id.indrive.comBlind SQL Injection · critical
   $4,134199 votes
3. inDriver Job - Admin Approval BypassIncorrect Authorization · medium
   $1,000157 votes
4. #1 XSS on watchdocs.indriverapp.comCross-site Scripting (XSS) - Reflected · low
   147 votes
5. SSRF in https://couriers.indrive.com/api/file-storageServer-Side Request Forgery (SSRF) · high
   141 votes
6. Full access to InDrive jira panel via exposed API token Information Disclosure · critical
   125 votes
7. Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`Business Logic Errors · medium
   110 votes
8. #2 XSS on watchdocs.indriverapp.comCross-site Scripting (XSS) - Reflected · medium
   101 votes
9. Reflected XSS of media.indrive.comCross-site Scripting (XSS) - Reflected · medium
   80 votes
10. # Drivers can access the customers phone number, current location without getting their offer accepted!Information Disclosure · medium
    79 votes
11. Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.Improper Access Control - Generic · high
    73 votes
12. Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction)Information Disclosure · medium
    73 votes
13. #3 XSS on watchdocs.indriverapp.comCross-site Scripting (XSS) - Reflected · low
    68 votes
14. Host Header Injection - internal.qa.delivery.indrive.comCRLF Injection · low
    66 votes
15. Stored XSS on promo.indrive.comCross-site Scripting (XSS) - Stored · medium
    $28447 votes
16. XSS on terra-6.indriverapp.comCross-site Scripting (XSS) - Reflected · medium
    43 votes