Valve · disclosed reports
Cross-site Scripting
8 disclosed reports · $10,750 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Valve on HackerOne- reports
- 8
- paid a bounty
- 5
Every one of the 8 is a mark on the map. Named now: 1 to 8, most upvoted first.
- XSS in steam react chat client
- Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name
- Stored XSS in the guide's GameplayVersion (www.dota2.com)
- Xss was found by exploiting the URL markdown on http://store.steampowered.com
- Reflected XSS in www.dota2.com
- Reflected XSS on help.steampowered.com
- XSS @ store.steampowered.com via agecheck path name
- Unfiltered input allows for XSS in "Playtime Item Grants" fields
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.