Weblate · disclosed reports
Input Validation and Logic
13 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Weblate on HackerOne- reports
- 13
- paid a bounty
- 0
Every one of the 13 is a mark on the map. Named now: 1 to 13, most upvoted first.
- Reset password cookie leads to account takeover
- Race Condition allows to get more free trials and get more than 100 languages and strings for free
- No rate limiting for Remove Account lead to huge Mass mailings
- no notification send to victim if attacker hacks/accesses his victims WebLate account.
- Reset password more than once with a reset link #2
- Running 2 accounts with a single email #3
- Reset password more than once with a reset link
- Running 2 accounts with a single email [Part 2]
- Running 2 accounts with a single email
- Persistence of Third Party Association.
- No Rate Limit On Add new word
- The username of an account can be ..
- Error Message When Changing Username
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.