Skip to content
BackEsc
Connect AISign inSign up free

weakness in SQL Injection

SQL Injection

313 disclosed reports · $169,755 paid · 282 valid · 5 informative · 1 duplicate · 5 N/A · 20 not checked yet

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

reports
313
valid
282
paid a bounty
80
no longer public
92

Every one of the 313 is a mark on the map. Named now: 157 to 182, most upvoted first.

  1. SQL Injection, exploitable in boolean mode#246412Eternal · 20 votesValid
  2. Blind SQL iNJECTION#1102591U.S. Dept Of Defense · 19 votesValid
  3. SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)#914427Engel & Völkers Technology GmbH · 19 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  4. SQLi allow query restriction bypass on exposed FileContentProvider#518669Nextcloud · $100 · 19 votesValid

    CVE-2019-15622

  5. SQL Injection in lapsuudenturva (viestinta.lahitapiola.fi)#191146LocalTapiola · 19 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  6. SQL Injection on /webApp/sijoitustalousuk email-parameter + potential lack of CSRF Token (viestinta.lahitapiola.fi)#191601LocalTapiola · $1,350 · 18 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  7. SQL injection at [█████████] [HtUS]#1626198U.S. Dept Of Defense · 17 votesValid
  8. SQL injection vulnerability on a DoD website#200623U.S. Dept Of Defense · 17 votesValid
  9. WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure#179920WordPress · 17 votesValid
  10. uchi.ru check_lessons Blind SQL Injection#1214814Mail.ru · $750 · 16 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  11. 100K CTF's Writeup#1216591h1-ctf · 15 votesValid
  12. https://zest.co.th/zestlinepay/checkproduct API endpoint suffers from Boolean-based SQL injection#783147Razer · 15 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  13. [typeorm] SQL Injection#506654Node.js third-party modules · 15 votesValid
  14. Blind SQL injection on ████████#313037U.S. Dept Of Defense · 15 votesValid
  15. [Informational] Possible SQL Injection in inc/ajax-actions-frontend.php#310280MapsMarker.com e.U. · 15 votesValid
  16. SQL Injection /webApp/sijoitustalous_peruutus locId parameter (viestinta.lahitapiola.fi)#181826LocalTapiola · $350 · 15 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  17. Sql Injection At █████████#1723896U.S. Dept Of Defense · 14 votesValid
  18. [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter#1024984U.S. Dept Of Defense · 14 votesValid
  19. SQL injection when configuring a database#983710ImpressCMS · 14 votesValid
  20. [api.easy2pay.co] SQL Injection in cashcard via card_no parameter ⭐️Bypassing IP whitelist⭐️#894329Razer · 14 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  21. Local SQL Injection in Content Provider (ru.mail.data.contact.ContactsProvider) of Mail.ru for Android, version 12.2.0.29734#887968Mail.ru · 14 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  22. [untitled-model] sql injection#507222Node.js third-party modules · 14 votesValid
  23. blind sql injection#374027Hanno's projects · 14 votesValid
  24. [query-mysql] SQL Injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database#311244Node.js third-party modules · 14 votesValid

    CVE-2018-3754

  25. SQL TEST#248037Gratipay · 14 votesN/A
  26. SQL injection vulnerability on a DoD website#189332U.S. Dept Of Defense · 14 votesValid

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated