Yelp · disclosed reports
Information Disclosure
16 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Yelp on HackerOne- reports
- 16
- valid
- 0
- paid a bounty
- 0
Every one of the 16 is a mark on the map. Named now: 1 to 16, most upvoted first.
- CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card
- Direct access to tox.ini file which is contain configuration details
- Leaking sensitive information lead to compromise employer API keys
- Robots.txt file with potentially sensitive content.
- Verification of email addresses possible through https://www.yelp.com/signup/facebook
- Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot
- Unauthorized Use of Victim Credit Card
- Requesting Show CheckIn Alert for Non Friend User
- installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins
- Ngnix Server version disclosure 404 Page!
- xmlrpc file enabled
- password field autocomplete enabled
- Nginx server version disclosure on engineeringblog
- JDBC credentials leaked via github
- Research papers on yelp are getting indexed by google bots.
- Nginx version disclosure via forbidden page
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP