Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlAnalysed#3694007 | Valid | Command and Code Injection | High | 2026-06-17 | $7,000 | 174 |
| HTML injection in email at https://www.hackerone.com/Analysed#1374017 | Valid | Command and Code Injection | Low | 2023-05-12 | – | 40 |
| RCE in profile picture uploadAnalysed#135072 | Valid | Command and Code Injection | – | 2016-06-08 | – | 32 |
| CSV Injection at the CSV export feature#118582 | Valid | Command and Code Injection | Low | 2019-04-08 | – | 15 |
| CSV Injection with the CVS export feature#72785 | Valid | Command and Code Injection | – | 2015-09-21 | – | 13 |
| CSV Injection via the CSV export feature#111192 | Valid | Command and Code Injection | – | 2016-02-16 | – | 10 |
| Reflected Filename Download#54034 | Valid | Command and Code Injection | – | 2016-04-25 | – | 9 |
| Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain#50658 | Valid | Command and Code Injection | – | 2015-04-16 | – | 4 |
| CSV Injection via the CSV export feature#124223 | Valid | Command and Code Injection | – | 2016-04-25 | – | 3 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.