Uber · disclosed reports
Command and Code Injection
11 disclosed reports · $31,500 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Uber on HackerOne- reports
- 11
- paid a bounty
- 7
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- RCE via npm misconfig -- installing internal libraries from the public registry
- uber.com may RCE by Flask Jinja2 Template Injection
- OneLogin authentication bypass on WordPress sites via XMLRPC
- Pre-auth Remote Code Execution on multiple Uber SSL VPN servers
- Blind OOB XXE At "http://ubermovement.com/"
- Privacy policy contains hardcoded link using unencrypted HTTP
- Mass Assignment Vulnerability in partners.uber.com
- Bypassing Uber Partner's 3 Cancel Limit
- newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf
- Command Injection, Information
- DOM based XSS on
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.