Skip to content
BackEsc
Connect AISign inSign up free

weakness in SQL Injection

SQL Injection

313 disclosed reports · $169,755 paid · 282 valid · 5 informative · 1 duplicate · 5 N/A · 20 not checked yet

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

reports
313
valid
282
paid a bounty
80
no longer public
92

Every one of the 313 is a mark on the map. Named now: 287 to 312, most upvoted first.

  1. `sql` does not properly escape parameters when building SQL queries, resulting in potential SQLi#319465Node.js third-party modules · 2 votesValid
  2. SQL Injection vulnerability in a DoD website#197754U.S. Dept Of Defense · 2 votesValid
  3. [tidaltrek.mail.ru] SQL Injection#142479Mail.ru · $150 · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  4. Possible SQL injection can cause denial of service attack#123660Dropbox · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  5. [orsotenslimselfie.lady.mail.ru] SQL Injection#115291Mail.ru · $300 · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  6. Possible SQL injection on "Jump to twitter"#81701Gratipay · 2 votesValid
  7. store-agent.mail.ru: stacked blind injection#60420Mail.ru · $400 · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  8. SQL injection, time zoom script, tile ID#17227Uzbey · 2 votesValid
  9. SQL inj#10468Mail.ru · $150 · 2 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  10. SQL Injection - https://███/█████████/MSI.portal#674838U.S. Dept Of Defense · 1 voteValid
  11. [increments] sql injection#508346Node.js third-party modules · 1 voteValid
  12. typeorm does not properly escape parameters when building SQL queries, resulting in potential SQLi#319458Node.js third-party modules · 1 voteValid
  13. SQL injection found in US Navy Website (http://███/)#197755U.S. Dept Of Defense · 1 voteValid
  14. Time Based SQL injection in url parameter#144359WebSummit · 1 voteInformative
  15. [tidaltrek.mail.ru] SQL Injection#140899Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  16. SQL Injection#137956Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  17. [3k.mail.ru] SQL Injection#116508Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  18. Blind SQL INJ#115304Paragon Initiative Enterprises · 1 voteN/A
  19. [parapa.mail.ru] SQL Injection#109212Mail.ru · $150 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  20. Time-Based Blind SQL Injection Attacks#78443Mail.ru · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  21. SQL Injection Vulnerability in Concrete5 version 5.7.3.1#59664Concrete CMS · 1 voteValid
  22. Time based sql injection#9921Mail.ru · $200 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  23. SQL injection [дырка в движке форума]#9919Mail.ru · $200 · 1 voteno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  24. First CTF ever!#1069263h1-ctf · 0 votesValid
  25. Two Error-Based SQLi in courses.aspx on ██████████#227102U.S. Dept Of Defense · 0 votesValid
  26. [afisha.mail.ru] SQL Injection#112555Mail.ru · $300 · 0 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated