HackerOne · disclosed reports
Command and Code Injection
9 disclosed reports · $7,000 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 9
- paid a bounty
- 1
Every one of the 9 is a mark on the map. Named now: 1 to 9, most upvoted first.
- Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql
- HTML injection in email at https://www.hackerone.com/
- RCE in profile picture upload
- CSV Injection at the CSV export feature
- CSV Injection with the CVS export feature
- CSV Injection via the CSV export feature
- Reflected Filename Download
- Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain
- CSV Injection via the CSV export feature
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.