Skip to content
Connect AISign inSign up free

Bug bounty program

WE

Weblate

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
6
Disclosed reports
157
Subdomains
36
Vendor on CyberSIXT
Weblate (2 CVEs, 0 exploited)

Most upvoted reports157

All reports
Most upvoted reports of Weblate
ReportWeaknessDisclosedBountyVotes
**Unauthenticated IDOR allows modification of payment customer billing information**Analysed#3869124Insecure Direct Object Reference2026-08-30–72
exposure of personal IP address via email.Analysed#3179850Information Disclosure2025-07-16–61
SSRF via URL Parser Differential in `normalize_request_url` (wlc)Analysed#3887969Server-Side Request Forgery2026-09-02–43
Reset password cookie leads to account takeoverAnalysed#1004536Input Validation and Logic2020-10-12–41
Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on WeblateAnalysed#3518571No weakness recorded2026-04-26–34
Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionAnalysed#3874004Command and Code Injection2026-09-15–34
Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in WeblateAnalysed#3898281Denial of Service2026-09-04–33
no captcha for register user and weak question attacker can spam emailAnalysed#236398Misconfiguration and Insecure Design2019-10-26–29
CSRF with logout actionAnalysed#1971589Cross-Site Request Forgery2023-06-16–29
API token sent to URL dictated by an untrusted project .weblate fileAnalysed#3825141Information Disclosure2026-09-04–27

Subdomains36

Root:weblate.org
Scope
Name suggests
First seen
Text fileClear filters36 names
Subdomains of Weblate
NameScopeFirst seen
benjamin.weblate.orgNot in the scope2026-11-14
betaweb.weblate.orgNot in the scope2026-11-14
cachet.weblate.orgNot in the scope2026-11-14
care.weblate.orgNot in the scope2026-11-14
debian.weblate.orgNot in the scope2026-11-14
debug.weblate.orgNot in the scope2026-11-14
demo.weblate.orgtestNot in the scope2026-11-14
docs.weblate.orgNot in the scope2026-11-14
dyson.weblate.orgNot in the scope2026-11-14
git.weblate.orggitNot in the scope2026-11-14
gotify.weblate.orgNot in the scope2026-11-14
graylog.weblate.orgmonitoringNot in the scope2026-11-14
helm.weblate.orgNot in the scope2026-11-14
hg.weblate.orgListed out of scope2026-11-14
hosted.weblate.orgIn scope2026-11-14
kotlin-sdk.weblate.orgNot in the scope2026-11-14
mail.weblate.orgmailNot in the scope2026-11-14
md.weblate.orgNot in the scope2026-11-14
meet.weblate.orgNot in the scope2026-11-14
benjamin.meet.weblate.orgNot in the scope2026-11-14
michal.meet.weblate.orgNot in the scope2026-11-14
mta-sts.weblate.orgNot in the scope2026-11-14
my.weblate.orgNot in the scope2026-11-14
nextcloud.weblate.orgNot in the scope2026-11-14
office.nextcloud.weblate.orgNot in the scope2026-11-14
nonexisting.weblate.orgNot in the scope2026-11-14
oldsupport.weblate.orgNot in the scope2026-11-14
s.weblate.orgNot in the scope2026-11-14
sentry.weblate.orgmonitoringNot in the scope2026-11-14
signalling.weblate.orgNot in the scope2026-11-14
statping.weblate.orgNot in the scope2026-11-14
status.weblate.orgmonitoringNot in the scope2026-11-14
status2.weblate.orgmonitoringNot in the scope2026-11-14
support.weblate.orgNot in the scope2026-11-14
www.weblate.orgNot in the scope2026-11-14
zammad.weblate.orgNot in the scope2026-11-14

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated