- Top reward
- $6,036
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 2
- Last change
At a glance
What to know before you start testing.
- Pays up to $6,036
- top reward, from $61.
- Report on GoBugfree
- Submit through the program page.
Rewards
What GoBugfree lists as the payout for each severity.
GoBugfree does not publish a reward table for this program.
Reward range in US dollars. GoBugfree's own page has the details.
Scope
6 assets you may test, 1 excluded.
Domains 6
- apihub.abacus.ch/endpoints/notodata
- apihub.abacus.ch/odata
- bug-bounty1-1.shop.abanet.io
- downloads.abacus.ch/downloads/abaclient
- downloads.abacus.ch/downloads/servicepacks/version-2025
- gobugfree.com
Out of scope (1)
- apihub.abacus.ch/rest
Changes
Tracked since 11 Nov 2026. Last checked 55 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
gobugfree.com
-
Scope added
https://downloads.abacus.ch/downloads/servicepacks/version-2025
-
Scope added
https://apihub.abacus.ch/endpoints/notodata
-
Scope added
https://bug-bounty1-1.shop.abanet.io/
-
Scope removed
Source Code
-
Scope removed
Abacus API
-
Scope removed
Abacus-ERP
-
Scope removed
Abacus-ERP Browser Edition
-
Scope removed
Not in Scope
-
Scope removed
MyAbacus Portal
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-1065 | A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not | High 8.1 | 19 Apr 2022 |
| CVE-2019-19381 | oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019_01_r4_20191021_0000 before prior to R4 (20.11.2019 Hotfix) allows Reflected Cross Site Scripting (XSS) via an error message. | Medium 6.1 | 11 Mar 2020 |