Bug bounty program
WC
WHO COVID-19 Mobile App
- Platform
- HackerOne
- Bounties
- None
- Assets in scope
- 5
- Disclosed reports
- 7
Most upvoted reports7
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Internal API endpoint is accesible for everyoneAnalysed#1066790 | Access Control | – | 39 | |
| Probably unexploitable XSS via Header InjectionAnalysed#836689 | Cross-site Scripting | – | 19 | |
| Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify UsersAnalysed#838647 | Input Validation and Logic | – | 15 | |
| DMARC and SPF recordsAnalysed#1064087 | No weakness recorded | – | 9 | |
| Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users#1064149 | Input Validation and Logic | – | 8 | |
| Error Page Text Injection (no compromise)#1065830 | Misconfiguration and Insecure Design | – | 4 | |
| ArcGIS Rest Service linked to unsecured survey data#1070344 | Authentication | – | 3 |
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 15 Nov 2026.