Bug bounty program · HackerOne
Phabricator
Most upvoted reports73
- #1070247ValidGit flag injection leads to arbitrary file writePhabricator · File and Path Handling · 2021–54votes
- #288704ValidCommand injection on Phabricator instance with an evil hg branch namePhabricator · Command and Code Injection · 2017–41votes
- #661978ValidIDOR bug to See hidden slowvote of any user even when you dont have access rightPhabricator · Insecure Direct Object Reference · 2019$30036votes
- #850114ValidSSRF in notifications.server configurationPhabricator · Server-Side Request Forgery · 2020$30028votes
- #17474ValidBroken Authentication and Session ManagementPhabricator · Authentication · 2014–26votes
- #216746ValidPhabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.Phabricator · Cryptography · 2017$75023votes
- #774ValidLog in a user to another accountPhabricator · Cross-Site Request Forgery · 2014$30021votes
- #758002ValidMarkdown parsing issue enables insertion of malicious tagsPhabricator · Cross-site Scripting · 2019–21votes
- #763177ValidUser can link non-public file attachments, leading to file disclose on edit by higher-privileged userPhabricator · Input Validation and Logic · 2022$50020votes
- #306414ValidWindow.opener protection BypassPhabricator · No weakness recorded · 2018$30019votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.