Skip to content
BackEsc
Connect AISign inSign up free

weakness in SQL Injection

SQL Injection

313 disclosed reports · $169,755 paid · 282 valid · 5 informative · 1 duplicate · 5 N/A · 20 not checked yet

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty; faint ones HackerOne no longer shows to the public. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

reports
313
valid
282
paid a bounty
80
no longer public
92

Every one of the 313 is a mark on the map. Named now: 209 to 234, most upvoted first.

  1. Multiple Vulnerabilities in Oracle Webcenter Sites (/cs/Satellite)#199082LocalTapiola · $600 · 9 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  2. Blind SQLi in a DoD Website#196300U.S. Dept Of Defense · 9 votesValid
  3. Time Based SQL Injection vulnerability on a DoD website#189851U.S. Dept Of Defense · 9 votesValid
  4. Time-based sql-injection на https://puzzle.mail.ru#170149Mail.ru · $300 · 9 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  5. SQL Injection in www.██████████#1015406U.S. Dept Of Defense · 8 votesValid
  6. SQL Injection leads to retrieve the contents of an entire database.#1002641BlockDev Sp. Z o.o · 8 votesDuplicate
  7. SQL injection at /admin.php?/cp/members/create#968240ExpressionEngine · 8 votesValid

    CVE-2020-8242

  8. SQL Injection or Denial of Service due to a Prototype Pollution#869574Node.js third-party modules · 8 votesValid

    CVE-2020-8158

  9. [███] SQL injection & Reflected XSS#484801U.S. Dept Of Defense · 8 votesValid
  10. [Android API] SQL injection ( errortoken.json )#204050Pornhub · 8 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  11. SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi)#200214LocalTapiola · 8 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  12. Sql injection on /webApp/sijoituswebinaari (viestinta.lahitapiola.fi)#200212LocalTapiola · 8 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  13. SQL Injection on /webApp/viivanalle (viestinta.lahitapiola.fi)#200210LocalTapiola · 8 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  14. SQLi in LASCO CME Query#186367U.S. Dept Of Defense · 8 votesValid
  15. SQL Injection via URL#3127562U.S. Dept Of Defense · 7 votesValid
  16. Taking Grinch Down To Save Holidays#1067037h1-ctf · 7 votesValid
  17. [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)#648346U.S. Dept Of Defense · 7 votesValid
  18. Weak credentials, Blind SQLi, Timing attack, that leads to web admin access#51458450m-ctf · 7 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
  19. SQL injection vulnerability on a DoD website#193936U.S. Dept Of Defense · 7 votesValid
  20. SQL injection vulnerability on a DoD website#189069U.S. Dept Of Defense · 7 votesValid
  21. [cfire.mail.ru] Time Based SQL Injection 2#111003Mail.ru · $200 · 7 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-15). Its title and metadata are kept here.
  22. SQL Injection - JSON 'name' parameter#3257171U.S. Dept Of Defense · 6 votesValid
  23. SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'#3127198U.S. Dept Of Defense · 6 votesValid
  24. SQL Injection - data[account][id] parameter#3127152U.S. Dept Of Defense · 6 votesValid
  25. Error-based blind SQL injection#3006666U.S. Dept Of Defense · 6 votesValid
  26. ccc.h1ctf.com CTF#1215919h1-ctf · 6 votesValid

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated