Skip to content
BackEsc
Sign in

HackerOne · disclosed reports

Cross-site Scripting

32 disclosed reports · $27,750 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open HackerOne on HackerOne
reports
32
paid a bounty
13

Every one of the 32 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. Reflected XSS on www.hackerone.com and resources.hackerone.com#840759HackerOne · $500 · 387 votes
  2. Cross-site Scripting (XSS) on HackerOne careers page#474656HackerOne · $500 · 239 votes
  3. Reflected XSS on www.hackerone.com via Wistia embed code#986386HackerOne · $500 · 236 votes
  4. DOM Based XSS in www.hackerone.com via PostMessage#398054HackerOne · $500 · 208 votes
  5. Markdown parsing issue enables insertion of malicious tags and event handlers#299728HackerOne · $5,000 · 184 votes
  6. RXSS at image.hackerone.live via the `url` parameter#2035332HackerOne · $500 · 171 votes
  7. IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier#449351HackerOne · $2,500 · 156 votes
  8. Stored XSS in IE11 on hackerone.com via custom fields#1173040HackerOne · 146 votes
  9. Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com#374919HackerOne · 129 votes
  10. Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget#1598347HackerOne · 122 votes
  11. DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054)#499030HackerOne · 106 votes
  12. Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid}#1558010HackerOne · 102 votes
  13. HTML Injection in email via Name field#1581499HackerOne · $500 · 84 votes
  14. Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)#995995HackerOne · 84 votes
  15. Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter#2106708HackerOne · 80 votes
  16. Potential stored Cross-Site Scripting vulnerability in Support Backend#858894HackerOne · 71 votes
  17. Query parameter reordering causes redirect page to render unsafe URL#293689HackerOne · $1,500 · 61 votes
  18. Stored XSS on https://events.hackerone.com#1028332HackerOne · 59 votes
  19. (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation#171398HackerOne · 44 votes
  20. IE 11 Self-XSS on Jira Integration Preview Base Link#212721HackerOne · $750 · 42 votes
  21. CSP not consistently applied#321HackerOne · 34 votes
  22. Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml#1028396HackerOne · 32 votes
  23. Stored Cross-Site Scripting vulnerability in example Custom Digital Agreement#983077HackerOne · 25 votes
  24. Self DOM-Based XSS in www.hackerone.com#406587HackerOne · 23 votes
  25. Improperly validated fields allows injection of arbitrary HTML via spoofed React objects#49652HackerOne · $5,000 · 23 votes
  26. HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension#1874260HackerOne · 21 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in