Skip to content
BackEsc
Connect AISign inSign up free

weakness in SQL Injection

SQL Injection

20 disclosed reports · $22,500 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

reports
20
valid
0
paid a bounty
11
no longer public
20

Every one of the 20 is a mark on the map. Named now: 1 to 20, most upvoted first.

  1. SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameter#819738Razer · $2,000 · 580 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  2. SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLog#811111Razer · $2,000 · 528 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  3. Blind SQL Injection#758654InnoGames · $2,000 · 432 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  4. SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter#781205Razer · $2,000 · 240 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  5. [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]#894325Razer · $4,000 · 232 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  6. Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)#363815Pornhub · 211 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  7. SQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid Parameter#777693Razer · $2,000 · 183 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  8. Blind SQL injection in Hall of Fap#295841Pornhub · 179 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  9. SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.#824307Razer · $2,000 · 122 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  10. SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id Parameter#768195Razer · $2,000 · 119 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  11. Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameter#790914Razer · $1,000 · 80 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  12. Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id]#789259Razer · $1,000 · 68 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  13. Time Based SQL-inject in post-parametr login[username] [domain - youporn.com]#203935Pornhub · $2,500 · 30 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  14. SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)#914427Engel & Völkers Technology GmbH · 19 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  15. https://zest.co.th/zestlinepay/checkproduct API endpoint suffers from Boolean-based SQL injection#783147Razer · 15 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  16. [api.easy2pay.co] SQL Injection in cashcard via card_no parameter ⭐️Bypassing IP whitelist⭐️#894329Razer · 14 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  17. [Android API] SQL injection ( errortoken.json )#204050Pornhub · 8 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  18. Weak credentials, Blind SQLi, Timing attack, that leads to web admin access#51458450m-ctf · 7 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  19. CTF Writeup#50702350m-ctf · 5 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  20. Possible SQL injection can cause denial of service attack#123660Dropbox · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated