weakness in Input Validation and Logic
Business Logic Errors
392 disclosed reports · $106,176 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 392
- paid a bounty
- 84
Every one of the 392 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Modify in-flight data to payment provider Smart2Pay
- H1514 Ability to MiTM Shopify PoS Session to Takeover Communications
- Hackerone is not properly deleting user id
- Double Payout via PayPal
- Getting New Invitations without Leaving Programs
- [fleet.city-mobil.ru] Driver balance increasing
- Race Condition allows to redeem multiple times gift cards which leads to free "money"
- An attacker can run pipeline jobs as arbitrary user
- Ethereum account balance manipulation
- An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss
- Fee discounts can be redeemed many times, resulting in unlimited fee-free transactions
- Change phone number OTP flaw leads to any phone number takeover
- [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)
- Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into state
- ETH contract handling errors
- Able to approve admin approval and change effective status without adding payment details .
- adding h1_analyst_* to username for normal users
- OLO Total price manipulation using negative quantities
- Abusing "Report as abuse" functionality to delete any user's post.
- 2-factor authentication can be disabled when logged in without confirming account password
- Takeover of Twitter-owned domain at mobileapplinking.com
- Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com
- Steal collateral during `end` process, by earning DSR interest after `flow`.
- Bypassing CORS Misconfiguration Leads to Sensitive Exposure
- [blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposure
- Bypassing HackerOne 2FA due to race condition
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.