Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Local File Inclusion path bypass#147570 | Valid | Misconfiguration and Insecure Design | – | 2016-08-19 | – | 13 |
| Local File Inclusion Vulnerability in Concrete5 version 5.7.3.1#59665 | Valid | Misconfiguration and Insecure Design | – | 2016-06-26 | – | 11 |
| HttpOnly flag not set for cookie on concrete5.org#4792 | Valid | Misconfiguration and Insecure Design | – | 2014-04-16 | – | 10 |
| Unsafe usage of Host HTTP header in Concrete5 version 5.7.3.1#59666 | Informative | Misconfiguration and Insecure Design | – | 2018-01-11 | – | 3 |
| Content Spoofing possible in concrete5.org#168078 | Valid | Misconfiguration and Insecure Design | – | 2017-07-23 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.