U.S. Dept Of Defense · disclosed reports
Cross-Site Request Forgery
25 disclosed reports · $500 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open U.S. Dept Of Defense on HackerOne- reports
- 25
- paid a bounty
- 1
Every one of the 25 is a mark on the map. Named now: 1 to 25, most upvoted first.
- CSRF leads to Account takeover
- CSRF leads to Account takeover
- CSRF Attack on changing security questions leads to full Account TakeOver
- Account takeover through CSRF in http://███████/██████████/default.asp
- CSRF Attack leads to delete album at
- CSRF to XSS
- CSRF to Cross-site Scripting (XSS)
- CSRF Account Deletion on ███ Website
- CSRF Attack leads to delete album at ████████
- CSRF - Close Account
- CSRF to account takeover in https://███████.mil/
- CSRF to ATO at https://█████/user/account [HtUS]
- CSRF to delete accounts [HtUS]
- CSRF in https://███
- CSRF to Stored HTML injection at https://www.█████
- CSRF to Cross-site Scripting (XSS)
- CSRF - Delete Account (Urgent)
- Account Takeover and Information update due to cross site request forgery via POST █████████/registration/my-account.cfm
- CSRF - Modify Company Info
- CSRF to account takeover in https://█████/
- ███████mill is vulnerable to cross site request forgery that leads to full account take over.
- Account takeover due to CSRF in "Account details" option on █████████
- CSRF - Modify User Settings with one click - Account TakeOver
- Cross-site request forgery vulnerability on a DoD website
- Cross-site request forgery (CSRF) vulnerability on a DoD website
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.