U.S. Dept Of Defense · disclosed reports
Cross-site Scripting
249 disclosed reports · $0 paid · 247 valid · 2 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open U.S. Dept Of Defense on HackerOne- reports
- 249
- valid
- 247
- paid a bounty
- 0
Every one of the 249 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Stored Xss Vulnerability on ████████
- CVE-2023-29489 XSS in cpanel at [www.███] - Securado, Oman
- Reflected XSS via Keycloak on ███ [CVE-2021-20323]
- Open Akamai ARL XSS on http://master-config-████████
- XSS found for https://█████████
- XSS on ███████
- Reflected Cross-site Scripting via search query on ██████
- Xss - ███
- Reflected XSS on error message on Login Page
- reflected xss [CVE-2020-3580]
- XSS vulnerability found in javascript code of https://███.mil
- Cross Site Scripting
- Open Akamai ARL XSS on http://media.████████
- XSS found in https://www.████████.mil
- Xss Parameter: /<s>/[*]/<s>.css ████████
- XSS in Cisco Endpoint
- Blind Stored XSS Payload fired at the backend on https://█████████/
- POST based RXSS on https://███████/ via ███ parameter
- Reflected xss on https://█████████
- Blind Stored XSS on the internal host - █████████████
- Reflected Xss
- [ CVE-2018-1000129 ] RXSS At `https://███████` via the URI
- XSS Reflected
- Reflected XSS
- Reflected XSS via Moodle on ███ [CVE-2022-35653]
- Reflected XSS in https://www.█████/
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.