Bug bounty program · HackerOne
General Motors
Most upvoted reports18
- #109395Validgmmovinparts.com SQLi via forgot_password.jspGeneral Motors · SQL Injection · 2016–22votes
- #172821ValidFlash XSS on homepage fliptilescrollerGeneral Motors · Cross-site Scripting · 2017–8votes
- #109461Validrefelected Xss on https://gmid.gm.com/gmid/jsp/GMIDInitialLogin.jspGeneral Motors · Cross-site Scripting · 2016–5votes
- #134004ValidReflected XSS and something more Store XSS tooGeneral Motors · Cross-site Scripting · 2017–5votes
- #172809ValidFlash XSS on global navGeneral Motors · Cross-site Scripting · 2017–5votes
- #179826ValidFlash XSS on Buick_RotatingMasthead_JellyBeanSlider.swfGeneral Motors · Cross-site Scripting · 2017–4votes
- #111999ValidFull Path Disclosure on gmchat.gm.comGeneral Motors · Information Disclosure · 2016–3votes
- #112001ValidXSS on gmchat.gm.comGeneral Motors · Cross-site Scripting · 2016–3votes
- #109352ValidXSS in GMGeneral Motors · Cross-site Scripting · 2016–2votes
- #116135ValidReflected Cross Site Script in www.gmcar.gm.comGeneral Motors · Cross-site Scripting · 2017–2votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.