U.S. Dept Of Defense · disclosed reports
Injection and Smuggling
19 disclosed reports · $0 paid · 19 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open U.S. Dept Of Defense on HackerOne- reports
- 19
- valid
- 19
- paid a bounty
- 0
Every one of the 19 is a mark on the map. Named now: 1 to 19, most upvoted first.
- XXE in DoD website that may lead to RCE
- HTTP Request Smuggling
- XXE on DoD web server
- [HTA2] XXE on https://███ via SpellCheck Endpoint.
- Request smuggling on ████████
- Resource Injection - [████████]
- XML External Entity (XXE) Injection
- XML Injection / External Service Interaction (HTTP/DNS) On https://█████████.mil
- DNN - Unrestricted Arbitrary File Upload #████████
- XML Injection on https://www.█████████ (███ parameter)
- XXE with RCE potential on the https://█████████ (CVE-2017-3548)
- XML E██████ternal Entity (XXE) Injection in ███
- Remote Code Execution (RCE) vulnerability in a DoD website
- Cross-site scripting (XSS) vulnerability on a DoD website
- LDAP Injection at ██████
- Swagger UI Injection via Config URL - `███`
- [CVE-2021-29156] LDAP Injection at https://██████
- CRLF Injection on ███████
- [CVE-2021-29156 on ForgeRock OpenAm] LDAP Injection in Webfinger Protocol!
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.