Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
A non-privileged user may create an admin account in StockyAnalysed#1245736	Valid	Access Control	Medium	2021-11-25	–	67
[h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilegeAnalysed#1091303	Valid	Information Disclosure	Medium	2021-04-08	–	46
Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KITAnalysed#909863	Valid	Insecure Direct Object Reference	Medium	2021-02-07	–	38
Low Privileged user can add or remove cash to/from sales registerAnalysed#905543	Valid	Access Control	Low	2021-06-16	–	37
None permission staff member can identify installed application and products attached to itAnalysed#848625	Valid	Information Disclosure	Low	2020-04-21	$500	26
Low Privileged Staff Member Can Export Billing ChargesAnalysed#1010835	Valid	Access Control	Medium	2020-11-26	$1,900	24
Staff Member can Get POS Access Without User InteractionAnalysed#1018094	Valid	No weakness recorded	Medium	2020-11-19	–	19

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.