Atmail bug bounty programs
atmail.com Updated
Atmail runs one public program: a self-hosted bug bounty paying up to $5,000.
- Top reward
- $5,000
- Self-hosted
- Programs
- 1
- 1 pays cash
- Targets in scope
- 14
- 5 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Atmail runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Atmail
Self-hosted · Bug bounty |
$5,000 | $2,000 | $500 | – | $5,000 | Full | Required | 7 days promised | Open |
-
- Critical
- $5,000
- High
- $2,000
- Medium
- $500
- Low
- –
- Safe harbor
- Full
- KYC
- Required
- First response
- 7 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
14 targets. 5 excluded.
-
*.atmail.cloud
Wildcards
-
*.atmail.com
Wildcards
-
*.atmailcloud.com
Wildcards
-
*.junara.com
Wildcards
-
atmail.com
Domains
-
atmailcloud.com
Domains
-
billing.atmail.com
Domains
-
junara.com
Domains
-
www.atmail.com
Domains
-
www.atmail.com , limited to content served from this website, excluding third-party components presented via this website
Web
-
All Atmail code shipped with its products, source and binaries, as supplied. Latest versions of currently shipped and supported products only.
Source code
-
Source code
Source code
-
All Atmail hosted services, public and private cloud installations
Products and areas
-
All Atmail-supplied customer service portals, third-party components excluded
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
status.atmail.com
-
success.atmail.com
-
All third-party services associated with Atmail services
-
Any domain that is a CNAME alias for a third-party system, or proxied through a CDN directly to a third-party platform (e.g. billing.atmail.com , success.atmail.com , status.atmail.com )
-
Atmail software that is end-of-life or no longer supported
Recent changes
Reward and scope changes across every Atmail program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Atmail products, from the NVD.
-
CVE-2024-24133 Critical
Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
-
CVE-2022-31200 Medium
Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.
-
CVE-2022-30776 Medium
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
-
CVE-2021-43574 Medium
WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
-
CVE-2012-2593 Medium
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
-
CVE-2017-11617 Medium
Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes.
-
CVE-2017-9517 High
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.
-
CVE-2017-9518 High
atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.
About this page
This page gathers every public program listed under atmail.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.