Basecamp · disclosed reports
Cross-site Scripting
9 disclosed reports · $6,337 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Basecamp on HackerOne- reports
- 9
- paid a bounty
- 3
Every one of the 9 is a mark on the map. Named now: 1 to 9, most upvoted first.
- HEY.com email stored XSS
- Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass
- DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover
- stored XSS in hey.com message content
- Stored XSS on trix editor version 2.1.1
- Possible DOM XSS on app.hey.com
- One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML
- Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce
- com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.