weakness in SQL Injection
SQL Injection
313 disclosed reports · $169,755 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 313
- paid a bounty
- 80
Every one of the 313 is a mark on the map. Named now: 1 to 26, most upvoted first.
- SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database
- SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent
- Time-Based SQL injection at city-mobil.ru
- SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameter
- SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLog
- Blind SQL Injection
- SQL Injection in report_xml.php through countryFilter[] parameter
- SQL injection at fleet.city-mobil.ru
- [windows10.hi-tech.mail.ru] Blind SQL Injection
- [www.zomato.com] SQLi - /php/██████████ - item_id
- SQL Injection on cookie parameter
- SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter
- SQL Injection in agent-manager
- Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice
- [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]
- Boolean-based SQL Injection on relap.io
- Blind SQL Injection in city-mobil.ru domain
- SQL LIKE clauses wildcard injection
- Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)
- Blind SQL Injection on starbucks.com.gt and WAF Bypass :*
- www.drivegrab.com SQL injection
- SQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid Parameter
- Blind SQL injection in Hall of Fap
- SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter
- Sql injection on docs.atavist.com
- bypass sql injection #1109311
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.