weakness in SQL Injection
SQL Injection
313 disclosed reports · $169,755 paid · 282 valid · 5 informative · 1 duplicate · 5 N/A · 20 not checked yet
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
- reports
- 313
- valid
- 282
- paid a bounty
- 80
- no longer public
- 92
Every one of the 313 is a mark on the map. Named now: 131 to 156, most upvoted first.
- SOAP WSDL Parser SQL Code Execution
- Time Based SQL-inject in post-parametr login[username] [domain - youporn.com]HackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
- Sql-inj in https://maximum.com/ajax/peopleHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
- Blind SQL Injection on █████ via URI Path
- Ability to escape database transaction through SQL injection, leading to arbitrary code execution
- SQL injection at [https://█████████] [HtUS]
- allods.mail.ru sql injectionHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
- SQLI on desafio5estrelas.com
- SQL injection
- [ipm.informatica.com] Sql injection Oracle
- SQL injection in partner id field on https://www.teavana.com (Sign-up form)
- SQL Injection on `/cs/Satellite` pathHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
- SQL Injection in the `move_papers.php` on the https://██████████
- SQL Injection /webApp/cancel_iltakoulu regId parameter (viestinta.lahitapiola.fi)HackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
- H1-CTF 100k Solution - Congratz on the 100k Rep todayisnew
- Blind Based SQL Injection in 3d.sc.money
- SQL injection on the https://████/
- SQL Injection in parameter REPORT
- SQL Injection on [█████████]
- Information Disclosure in https://www.rockstargames.com/search
- [critical] sql injection by GET method
- gmmovinparts.com SQLi via forgot_password.jsp
- SQL Injection on █████
- Drupal 7 pre auth sql injection and remote code execution
- time based SQL injection at [https://███] [HtUS]
- Saving Christmas from Grinchy Gods
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.