weakness in SQL Injection
SQL Injection
313 disclosed reports · $169,755 paid · 282 valid · 5 informative · 1 duplicate · 5 N/A · 20 not checked yet
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
- reports
- 313
- valid
- 282
- paid a bounty
- 80
- no longer public
- 57
Every one of the 313 is a mark on the map. Named now: 79 to 104, most upvoted first.
- [www.zomato.com] Union SQLi + Waf Bypass
- SQL injection in 3rd party software Anomali
- Time-base SQL Injection in Search Users
- Blind SQL in id_locality GET param on [city-mobil.ru/taxiserv]HackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- Multiple vulnerabilities in a WordPress plugin at drive.uber.com
- SQL Injection in IBM access control panel & Broken access in admin panel
- [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php
- SQL Injection https://www.olx.co.idHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- Time-based blind SQL injection
- Potential SQL Injection when annotating FilteredRelation on PostgreSQL
- Blind SQL Injection on news.mail.ruHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- A SQL injection vulnerability in VanillaHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
- SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)
- [contact-sys.com] SQL Injection████ limit param
- Blind SQL injection via clientid parameter in zone‑include.php
- SQL injection in https://demor.adr.acronis.com/ via the username parameter
- SQL Injection in ████
- Sqli on ██████ search functionality
- SQL Injection vulnerability located at ████████
- Vanilla SQL Injection VulnerabilityHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
- [city-mobil.ru/taxiserv/] SQLi at /taxiserv/tariffs/dictionary at filter{"id_locality"} paramHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- Blind SQL Injection
- SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners
- SQLi at █████ parameter
- sql injection via https://setup.p2p.ihost.com/
- Multiple SQL Injections and constrained LFI in esk-static.3igames.mail.ruHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.