Skip to content
BackEsc
Connect AISign inSign up free

weakness in SQL Injection

SQL Injection

27 disclosed reports · $10,650 paid · 25 valid · 1 informative · 1 N/A

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

reports
27
valid
25
paid a bounty
14
no longer public
16

Every one of the 27 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. SQL Injection on sctrack.email.uber.com.cn#150156Uber · $4,000 · 93 votesValid
  2. Multiple vulnerabilities in a WordPress plugin at drive.uber.com#135288Uber · 55 votesValid
  3. SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)#181803LocalTapiola · $1,350 · 50 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  4. SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/#125932Uber · $3,000 · 39 votesValid
  5. SQL Injection in sijoitustalous_peruutus (viestinta.lahitapiola.fi)#190434LocalTapiola · 36 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  6. SQL Injection on `/cs/Satellite` path#164739LocalTapiola · 27 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  7. gmmovinparts.com SQLi via forgot_password.jsp#109395General Motors · 22 votesValid
  8. SQL Injection /webApp/sijoitustalous_peruutus locId parameter (viestinta.lahitapiola.fi)#181826LocalTapiola · $350 · 15 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  9. Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru]#141329Mail.ru · 12 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  10. [informatica.com] Blind SQL Injection#117073Informatica · 11 votesValid
  11. Time-based sql-injection на https://puzzle.mail.ru#170149Mail.ru · $300 · 9 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  12. [townwars.mail.ru] Time-Based SQL Injection#144674Mail.ru · $150 · 5 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  13. SQLi in love.uber.com#125181Uber · 4 votesValid
  14. vk.com/login.php#116764VK.com · 4 votesValid
  15. SQL injection in conc/index.php/ccm/system/search/users/submit#38778Concrete CMS · 3 votesValid
  16. [tidaltrek.mail.ru] SQL Injection#142479Mail.ru · $150 · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  17. [orsotenslimselfie.lady.mail.ru] SQL Injection#115291Mail.ru · $300 · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  18. Possible SQL injection on "Jump to twitter"#81701Gratipay · 2 votesValid
  19. Time Based SQL injection in url parameter#144359WebSummit · 1 voteInformative
  20. [tidaltrek.mail.ru] SQL Injection#140899Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  21. SQL Injection#137956Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  22. [3k.mail.ru] SQL Injection#116508Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  23. Blind SQL INJ#115304Paragon Initiative Enterprises · 1 voteN/A
  24. [parapa.mail.ru] SQL Injection#109212Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  25. Time-Based Blind SQL Injection Attacks#78443Mail.ru · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  26. [afisha.mail.ru] SQL Injection#112555Mail.ru · $300 · 0 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated