Bug bounty program · HackerOne
Most upvoted reports18
- #1376672ValidStored XSS in Email Templates via linkJudge.me · Cross-site Scripting · 2021$50081votes
- #1339034ValidBlind XSS via Feedback form.Judge.me · Cross-site Scripting · 2022–57votes
- #1404804ValidEmail templates XSS by filterXSS bypassJudge.me · Cross-site Scripting · 2022$1,25051votes
- #1410498ValidIDOR: leak buyer info & Publish/Hide foreign commentsJudge.me · Insecure Direct Object Reference · 2022$1,25047votes
- #1427589ValidLog4j RCE on https://judge.me/reviewsJudge.me · Command and Code Injection · 2021$5040votes
- #1404770ValidStored XSS in "product type" field executed via product filtersJudge.me · No weakness recorded · 2022$50030votes
- #1566017ValidRace condition on https://judge.me/peopleJudge.me · Race Conditions · 2022$25026votes
- #1398285ValidStored XSS in Public Profile ReviewsJudge.me · Cross-site Scripting · 2023$25025votes
- #1609955ValidImproper Access Control in Ali Express ImporterJudge.me · Access Control · 2023–21votes
- #1595905ValidXSS in Widget Review Form Preview in settingsJudge.me · Cross-site Scripting · 2022–16votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.