Bug bounty program · HackerOne
Most upvoted reports157
- #3869124Valid**Unauthenticated IDOR allows modification of payment customer billing information**Weblate · Insecure Direct Object Reference · 2026 · High · no account (title)–72votes
- #3179850Validexposure of personal IP address via email.Weblate · Information Disclosure · 2025–61votes
- #3887969ValidSSRF via URL Parser Differential in `normalize_request_url` (wlc)Weblate · Server-Side Request Forgery · 2026 · High–43votes
- #1004536ValidReset password cookie leads to account takeoverWeblate · Input Validation and Logic · 2020–41votes
- #3518571ValidArgument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on WeblateWeblate · No weakness recorded · 2026–34votes
- #3874004ValidIncomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionWeblate · Command and Code Injection · 2026 · High–34votes
- #3898281ValidUnauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in WeblateWeblate · Denial of Service · 2026 · High · no account (title)–33votes
- #236398Validno captcha for register user and weak question attacker can spam emailWeblate · Misconfiguration and Insecure Design · 2019–29votes
- #1971589ValidCSRF with logout actionWeblate · Cross-Site Request Forgery · 2023–29votes
- #3825141ValidAPI token sent to URL dictated by an untrusted project .weblate fileWeblate · Information Disclosure · 2026 · Medium–27votes
Subdomains36
1 covered by the program's own scope · 0 first seen this week
Name suggestsAnything
36 names
| Name | Scope | First seen |
|---|---|---|
| benjamin.weblate.org | Not in the scope | 2026-11-14 |
| betaweb.weblate.org | Not in the scope | 2026-11-14 |
| cachet.weblate.org | Not in the scope | 2026-11-14 |
| care.weblate.org | Not in the scope | 2026-11-14 |
| debian.weblate.org | Not in the scope | 2026-11-14 |
| debug.weblate.org | Not in the scope | 2026-11-14 |
| demo.weblate.orgtest | Not in the scope | 2026-11-14 |
| docs.weblate.org | Not in the scope | 2026-11-14 |
| dyson.weblate.org | Not in the scope | 2026-11-14 |
| git.weblate.orggit | Not in the scope | 2026-11-14 |
| gotify.weblate.org | Not in the scope | 2026-11-14 |
| graylog.weblate.orgmonitoring | Not in the scope | 2026-11-14 |
| helm.weblate.org | Not in the scope | 2026-11-14 |
| hg.weblate.org | Listed out of scope | 2026-11-14 |
| hosted.weblate.org | In scope | 2026-11-14 |
| kotlin-sdk.weblate.org | Not in the scope | 2026-11-14 |
| mail.weblate.orgmail | Not in the scope | 2026-11-14 |
| md.weblate.org | Not in the scope | 2026-11-14 |
| meet.weblate.org | Not in the scope | 2026-11-14 |
| benjamin.meet.weblate.org | Not in the scope | 2026-11-14 |
| michal.meet.weblate.org | Not in the scope | 2026-11-14 |
| mta-sts.weblate.org | Not in the scope | 2026-11-14 |
| my.weblate.org | Not in the scope | 2026-11-14 |
| nextcloud.weblate.org | Not in the scope | 2026-11-14 |
| office.nextcloud.weblate.org | Not in the scope | 2026-11-14 |
| nonexisting.weblate.org | Not in the scope | 2026-11-14 |
| oldsupport.weblate.org | Not in the scope | 2026-11-14 |
| s.weblate.org | Not in the scope | 2026-11-14 |
| sentry.weblate.orgmonitoring | Not in the scope | 2026-11-14 |
| signalling.weblate.org | Not in the scope | 2026-11-14 |
| statping.weblate.org | Not in the scope | 2026-11-14 |
| status.weblate.orgmonitoring | Not in the scope | 2026-11-14 |
| status2.weblate.orgmonitoring | Not in the scope | 2026-11-14 |
| support.weblate.org | Not in the scope | 2026-11-14 |
| www.weblate.org | Not in the scope | 2026-11-14 |
| zammad.weblate.org | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.