Browse / pixiv

pixiv

See its reports on the map

Attack surface: 117,017 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to pixiv

• Cross-site Scripting3
• Access Control2
• Open Redirect2
• Authentication1
• Insecure Direct Object Reference1
• Information Disclosure1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Reset any passwordWeak Password Recovery Mechanism for Forgotten Password · high
   313 votes
2. Stealing Users OAuth authorization code via redirect_uriImproper Authorization · high
   $2,000253 votes
3. Disclose Hidden Comments on Media Section of hub.vroid.comInsecure Direct Object Reference (IDOR) · medium
   $500149 votes
4. Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Information Disclosure · high
   145 votes
5. XSS reflected on [https://www.pixiv.net]Cross-site Scripting (XSS) - Reflected · medium
   $500144 votes
6. Non-premium user can disable Ads in japanese version of dic.pixiv.netBusiness Logic Errors · high
   $3,000123 votes
7. clickjacing can lead to account takeoverUI Redressing (Clickjacking) · low
   $20070 votes
8. XSS Reflected at https://sketch.pixiv.net/ Via `next_url`Cross-site Scripting (XSS) - Reflected · medium
   64 votes
9. Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netImproper Access Control - Generic · low
   53 votes
10. RCE due to ImageTragick v2Code Injection · critical
    $2,00044 votes
11. Open redirect protection (https://www.pixiv.net/jump.php) is broken for novelsOpen Redirect · low
    $20042 votes
12. CSRF at https://chatstory.pixiv.net/importedCross-Site Request Forgery (CSRF) · medium
    $50031 votes
13. Bypass extension check leads to stored XSS at https://s2.booth.pmCross-site Scripting (XSS) - Stored · medium
    30 votes
14. Open Redirect at https://oauth.secure.pixiv.netOpen Redirect · low
    $20029 votes