Open Bug Bounty selected among the
Top 5 Bug Bounty programs to watch
by The Hacker News

All Open Bug Bounty emails are sent only from openbugbounty.org domain being digitally signed. All others are fake. Learn more.
  • For Researchers 
    Report a Vulnerability
    Report and help remediate a vulnerability
    found on any website

         		Write a Blog Post
    Write a blog post to share your knowledge
    and get kudos
    Browse Bug Bounty Programs
    Browse active bug bounty programs
    run by website owners         		Ask a Question
    Ask questions and share your improvement
    ideas
    How it Works
    Download presentation and learn
    how our platform works

        PDF, 1MB
  • For Owners 
    Start a Bug Bounty
    Start your bug bounty program at no cost
    and leverage crowd-security testing

         		Ask a Question
    Ask questions or let us know how to make
    Open Bug Bounty even better
    API Request
    National CERTs and law enforcement
    agencies may request our API
    How it Works
    Download presentation and learn
    how our platform works

        PDF, 1MB
  • Hall of Fame 
    Top Security Researchers
    They make Web a safer place by reporting
    and helping remediate vulnerabilities

         		Acknowledgements
    Website owners share their experience of collaboration with the researchers






    How it Works
    Download presentation and learn
    how our platform works

        PDF, 1MB
  • About 
    About the Project
    Read about Open Bug Bounty history,
    values and mission

         		Latest Reports
    Browse the most recent vulnerability
    submissions
    Contact Us
    Get in touch


    How it Works
    Download presentation and learn
    how our platform works

        PDF, 1MB
  • Forum
  • Blog
  •       
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
 1,247,968 coordinated disclosures
901,397 fixed vulnerabilities
1,589 bug bounty programs, 3,156 websites
28,494 researchers, 1,443 honor badges

OpenBugBounty.org  >  OBB-1247099

Are you sure you want to delete the vulnerability?
Yes No

This feature enables you to send additional notifications to the website owners or admins after the vulnerability is submitted. The total number of additional notification is limited to 10, and to 1 in 24 hours.

Notify specific security contact:


To my best knowledge this email belongs to the website owner/admin


apps.tga.gov.au Cross Site Scripting Vulnerability
Report ID: OBB-1247099

Security Researcher devl00p Helped patch 85653 vulnerabilities
Received 11 Coordinated Disclosure badges
Received 36 recommendations , a holder of 11 badges for responsible and coordinated disclosure, found Cross Site Scripting security vulnerability affecting apps.tga.gov.au website and its users.

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

      a. verified the vulnerability and confirmed its existence;
      b. notified the website operator about its existence.

Affected Website:apps.tga.gov.au  
Open Bug Bounty Program:Create your bounty program now. It's open and free.
Vulnerable Application:Custom Code
Vulnerability Type:XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:devl00p Helped patch 85653 vulnerabilities
Received 11 Coordinated Disclosure badges
Received 36 recommendations
Remediation Guide:OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

HTTP POST data: