Skip to content
BackEsc
Connect AISign inSign up free

weakness in SQL Injection

SQL Injection

313 disclosed reports · $169,755 paid · 282 valid · 5 informative · 1 duplicate · 5 N/A · 20 not checked yet

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

reports
313
valid
282
paid a bounty
80
no longer public
92

Every one of the 313 is a mark on the map. Named now: 183 to 208, most upvoted first.

  1. ccc ctf#1216085h1-ctf · $100 · 13 votesValid
  2. SQL injections#272506U.S. Dept Of Defense · 13 votesValid
  3. GitHub Security Lab (GHSL) Vulnerability Report: SQLInjection in FileContentProvider.kt (GHSL-2022-059)#1650264ownCloud · $300 · 12 votesValid
  4. stripo blog search SQL Injection#761382Stripo Inc · 12 votesValid
  5. SQL Injection in Login Page: https://█████/█████████/login.php#447742U.S. Dept Of Defense · 12 votesValid
  6. SQL injection on █████ due to tech.cfm#310031U.S. Dept Of Defense · 12 votesValid
  7. Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru]#141329Mail.ru · 12 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  8. NoSQL injection in listEmojiCustom method call#1757676Rocket.Chat · 11 votesValid

    CVE-2023-28359

  9. bit.games - sql-inj#862836Mail.ru · $1,500 · 11 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  10. [www.zomato.com] Abusing LocalParams (city) to Inject SOLR query#844428Eternal · $100 · 11 votesValid
  11. SQL Injection and plaintext passwords via User Search#703819IBM · 11 votesValid
  12. MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypass#577612U.S. Dept Of Defense · 11 votesValid
  13. SQL Injection on https://████████/#232378U.S. Dept Of Defense · 11 votesValid
  14. SQL Injection vulnerability in a DoD website#216699U.S. Dept Of Defense · 11 votesValid
  15. [informatica.com] Blind SQL Injection#117073Informatica · 11 votesValid
  16. SQL Injection in URI Path Leading to Full Database Disclosure on ████████#3234050U.S. Dept Of Defense · 10 votesValid
  17. SQL Injection in █████#1489744U.S. Dept Of Defense · 10 votesValid
  18. SQL injextion via vulnerable doctrine/dbal version#1390331Nextcloud · 10 votesValid

    CVE-2021-43608

  19. [city-mobil.ru/taxiserv/] SQLi at /taxiserv/requests path at driver_company param#1079480Mail.ru · 10 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  20. SQLi in login form of █████#982202U.S. Dept Of Defense · 10 votesValid
  21. Blind SQL Injection#771215U.S. Dept Of Defense · 10 votesValid
  22. Blind SQL Injection#221757ok.ru · 10 votesValid
  23. [afocusp.informatica.com] Sql injection afocusp.informatica.com:37777#178632Informatica · 10 votesValid
  24. Regex account takeover#1581059Rocket.Chat · 9 votesValid

    CVE-2022-32211

  25. SQLi on █████████#954667U.S. Dept Of Defense · 9 votesValid
  26. SQL injection [futexpert.mtngbissau.com]#924855MTN Group · 9 votesValid

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated