Skip to content
BackEsc
Sign in

weakness in SQL Injection

SQL Injection

313 disclosed reports · $169,755 paid · 42 valid · 2 informative · 1 N/A · 268 not checked yet

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

reports
313
valid
42
paid a bounty
80

Every one of the 313 is a mark on the map. Named now: 27 to 52, most upvoted first.

  1. SQL Injection [unauthenticated] with direct output at https://news.mail.ru/#818972Mail.ru · $7,500 · 156 votes
  2. SQLi | in URL paths#2958619MTN Group · 149 votes
  3. SQL Injection vulnerability found on ibm.com endpoint#3578842IBM · 137 votes
  4. Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json#952501Eternal · $2,000 · 137 votes
  5. [intensedebate.com] SQL Injection Time Based On /js/commentAction/#1044698Automattic · 130 votes
  6. SQL injection in structure plugin#3249794ExpressionEngine · 125 votes
  7. SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.#824307Razer · $2,000 · 122 votes
  8. SQL Injection at https://files.palantir.com/ due to CVE-2021-38159#1525200Palantir Public · 121 votes
  9. SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id Parameter#768195Razer · $2,000 · 119 votes
  10. SQL injection on admin.acronis.host development web service#923020Acronis · $250 · 118 votes
  11. SQL injection in URL path leads to Database Access#2633959MTN Group · 115 votes
  12. SQL injection in https://www.acronis.cz/ via the log parameter#1109311Acronis · 103 votes
  13. SQL Injection intensedebate.com#1069561Automattic · 102 votes
  14. Complete authentication bypass to admin permissions#3564655Rocket.Chat · 100 votes
  15. SQL Injection when using FilteredRelation#3292573Django · 96 votes
  16. Woocommerce SQL Injection in WC_Report_Coupon_Usage#3198980Automattic · 96 votes
  17. Time based SQL injection at████████#2312334U.S. Dept Of Defense · 96 votes
  18. Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0#3395221Revive Adserver · 93 votes
  19. SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscription#2209130Mozilla · 93 votes
  20. turboslim.lady.mail.ru - Blind sql-injection.#795291Mail.ru · $5,000 · 93 votes
  21. SQL Injection on sctrack.email.uber.com.cn#150156Uber · $4,000 · 93 votesValid
  22. SQL Injection#2737595U.S. Dept Of Defense · 91 votes
  23. SQL Injection in CVE Discovery Search#1893800HackerOne · 87 votes
  24. [SQLI ]Time Bassed Injection at ██████████ via referer header#995122U.S. Dept Of Defense · 87 votes
  25. SQL injection on jd.mail.ru#365011Mail.ru · $300 · 87 votes
  26. 3igames.mail.ru SQL Injection#790005Mail.ru · $1,500 · 86 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in