Skip to content
BackEsc
Sign in

weakness in Input Validation and Logic

Improper Input Validation

76 disclosed reports · $29,382 paid

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

reports
76
paid a bounty
18

Every one of the 76 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`#684092BlockDev Sp. Z o.o · 466 votes
  2. Bypass of GitLab CI runner slash fix in YAML validation#409395GitLab · 363 votes
  3. Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)#3175695Mozilla · 98 votes
  4. HTML Injection on tiktoktutorials via firstName parameter#1343492TikTok · 97 votes
  5. Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.org#3279441Mozilla · $500 · 93 votes
  6. moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input Validation#2585374Internet Bug Bounty · $2,600 · 89 votes
  7. Deadlock in x86 HVM standard VGA handling#2921724Internet Bug Bounty · $2,162 · 88 votes
  8. Improper UUID validation results in bypass of #419896#423073HackerOne · 82 votes
  9. ImageId Format Injection in Image Upload Endpoint#3175928Lichess · 73 votes
  10. jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing#37895708x8 · $100 · 72 votes
  11. Residual Malicious Payloads on HackerOne after Vulnerability Fixes#3168691HackerOne · 72 votes
  12. [API] ICQ user's avatar can be manipulated remotely#786745Mail.ru · $1,000 · 70 votes
  13. Incorrect Deep-link validation leading to unresponsive application and device#1157795Flickr · 64 votes
  14. HTTP/3 Stream Dependency Cycle Exploit#3125832curl · 60 votes
  15. [Source Engine] Material path truncation leads to Remote Code Execution#544096Valve · $2,500 · 60 votes
  16. HTML injection at face.city-mobil.ru#757100Mail.ru · $500 · 57 votes
  17. Html injection in event Description#2215418LinkedIn · 55 votes
  18. CVE-2020-8177: curl overwrite local file with -J#887462curl · 55 votes
  19. Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`#684152BlockDev Sp. Z o.o · 55 votes
  20. important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)#2585381Internet Bug Bounty · $4,920 · 51 votes
  21. Posts sent via websockets aren't sanitized properly#2541027Mattermost · $150 · 40 votes
  22. CSS Injection to disable app & potential message exfil#679969Slack · 37 votes
  23. MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate#3702718curl · 36 votes
  24. Improper input validation in projects leads to fully deny access to project resources#1237700Semrush · 35 votes
  25. Bypass parsing of transaction data, users on the phishing site will transfer/approve ERC20 tokens without being alerted#1651429MetaMask · $1,000 · 32 votes
  26. athome.starbucks.com - URL parameter tampering of review forms permitted possible content injection#367589Starbucks · 31 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in