Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Can upload files without authentication on AirFibre 3.2#201529 | Valid | Misconfiguration and Insecure Design | – | 2017-05-17 | – | 4 |
| Unauthenticated Cross-Site Scripting in Web Management Console#121941 | Valid | Cross-site Scripting | – | 2017-10-02 | – | 8 |
| Unauthenticated request allows changing hostname#802079 | Valid | Authentication | – | 2020-04-10 | – | 10 |
| Ability to log in as any user without authentication if █████████ is empty#215053 | Valid | Authentication | – | 2017-08-08 | – | 54 |
| Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928 | Valid | Command and Code Injection | – | 2019-11-08 | – | 553 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.