Bug bounty program · HackerOne
Most upvoted reports5
- #4020767ValidUnauthenticated API allows reading, writing to and deleting any user's private chat history on ████████Essity · Misconfiguration and Insecure Design · 2026 · Critical · no account (title)–68votes
- #3729501ValidPre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)Essity · Cross-site Scripting · 2026 · Critical · no account (title)–48votes
- #3802451ValidHTML Injection in Contact Form Email Enables Phishing via Legitimate ████████ InfrastructureEssity · Injection and Smuggling · 2026 · Medium–42votes
- #3778282ValidCritical SQL Injection WDM API (████████)Essity · SQL Injection · 2026 · Critical–40votes
- #4071064ValidUnauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor dataEssity · Authentication · 2026 · Medium · no account (title)–29votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.