HackerOne · disclosed reports
Cross-Site Request Forgery
18 disclosed reports · $8,850 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 18
- paid a bounty
- 9
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone
- Slack integration setup lacks CSRF protection
- Login CSRF vulnerability on hackerone.com
- HackerOne reports escalation to JIRA is CSRF vulnerable
- Information leakage via CSV when content is valid JavaScript
- Switching the user to the attacker's account
- Information disclosure (reset password token) and changing the user's password
- CSRF login
- HackerOne is still prone to Internet Explorer UXSS
- CSRF allows to test email forwarding
- Possible CSRF during joining report as participant
- Possible CSRF during external programs
- CSRF possible when SOP Bypass/UXSS is available
- A password reset page does not properly validate the authenticity token at the server side.
- CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain
- Limited CSRF bypass.
- Websites opened from reports can change url of report page
- Marking notifications as read CSRF bug
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.