U.S. Dept Of Defense · disclosed reports
SQL Injection
75 disclosed reports · $0 paid · 75 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open U.S. Dept Of Defense on HackerOne- reports
- 75
- valid
- 75
- paid a bounty
- 0
Every one of the 75 is a mark on the map. Named now: 27 to 52, most upvoted first.
- [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter
- SQL injection vulnerability on a DoD website
- SQL injections
- SQL Injection in Login Page: https://█████/█████████/login.php
- SQL injection on █████ due to tech.cfm
- MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypass
- SQL Injection on https://████████/
- SQL Injection vulnerability in a DoD website
- SQL Injection in URI Path Leading to Full Database Disclosure on ████████
- SQL Injection in █████
- SQLi in login form of █████
- Blind SQL Injection
- SQLi on █████████
- Blind SQLi in a DoD Website
- Time Based SQL Injection vulnerability on a DoD website
- SQL Injection in www.██████████
- [███] SQL injection & Reflected XSS
- SQLi in LASCO CME Query
- SQL Injection via URL
- [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)
- SQL injection vulnerability on a DoD website
- SQL injection vulnerability on a DoD website
- SQL Injection - JSON 'name' parameter
- SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'
- SQL Injection - data[account][id] parameter
- Error-based blind SQL injection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.