weakness in SQL Injection
SQL Injection
313 disclosed reports · $169,755 paid · 281 valid · 5 informative · 1 duplicate · 5 N/A · 21 not checked yet
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
- reports
- 313
- valid
- 281
- paid a bounty
- 80
- no longer public
- 49
Every one of the 313 is a mark on the map. Named now: 53 to 78, most upvoted first.
- Blind Sql Injection in https://████
- SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
- [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.php
- Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameterHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- SQL Injection on www.██████████ on countID parameter
- SQL Injection in Django ORM via Unvalidated `_connector` in Q Objects
- Arbitrary SQL command injection
- SQL injection delivery-club.ru (ClickHouse)HackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- SQL Injection on https://www.olx.co.idHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- SQL Injection at https://████ via ███ parameter
- SQL Injection in ████
- sqli on █████████ search functionality
- [https://reviews.zomato.com] Time Based SQL Injection
- SQL injection in JSONField KeyTransform
- Blind SQL injection at tsftp.informatica.com
- [www.zomato.com] Blind SQL Injection in /php/geto2banner
- Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id]HackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- Boolen Based Blind Sql Injection Via User Agent in ███.mil
- Time Based SQL Injection
- SQL injection at ███████
- [www.zomato.com] SQLi on `order_id` parameter
- SQLi At `███████` via `theme_name`
- SQL Injection at https://lite.r-keeper.ru/site_api/clients/derision/?lang=ruHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- CVE-2024-53908: Django Potential SQL injection in `HasKey(lhs, rhs)` on Oracle
- Unauthenticated SQL Injection at █████████ [HtUS]
- Blind SQL injection in third-party software, that allows to reveal user statistic from rocket.chat and possibly hack into the rocketchat.agilecrm.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.