Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
[persistent cross-site scripting] customers can target admins#55842	Valid	Cross-site Scripting	–	2015-07-01	–	4
deleted staff member can add his amazon marketplace web services account to the store.#99374	Valid	Authentication	–	2015-11-18	–	4
Staff member can delete Private Apps#155704	Valid	Access Control	–	2016-08-09	–	7
S3 Buckets open to the world thanks to 'Authenticated Users' ACL#98819	Valid	Authentication	–	2016-02-23	$1,000	14
Staff Member can Get POS Access Without User Interaction#1018094	Valid	No weakness recorded	Medium	2020-11-19	–	19
Low Privileged Staff Member Can Export Billing Charges#1010835	Valid	Access Control	Medium	2020-11-26	$1,900	24
None permission staff member can identify installed application and products attached to it#848625	Valid	Information Disclosure	Low	2020-04-21	$500	26
Low Privileged user can add or remove cash to/from sales register#905543	Valid	Access Control	Low	2021-06-16	–	37
Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT#909863	Valid	Insecure Direct Object Reference	Medium	2021-02-07	–	38
[h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege#1091303	Valid	Information Disclosure	Medium	2021-04-08	–	46
A non-privileged user may create an admin account in Stocky#1245736	Valid	Access Control	Medium	2021-11-25	–	67

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.