Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| no captcha for register user and weak question attacker can spam emailAnalysed#236398 | Valid | Misconfiguration and Insecure Design | – | 2019-10-26 | – | 29 |
| Insecure Account Removal #2Analysed#229532 | Valid | Misconfiguration and Insecure Design | Low | 2018-08-28 | – | 16 |
| Password Restriction#229920 | Valid | Misconfiguration and Insecure Design | Low | 2017-08-19 | – | 12 |
| flood of comment no rate limit on commnets >> by using different user agent#404035 | Valid | Misconfiguration and Insecure Design | Low | 2018-09-28 | – | 11 |
| Weak e-mail change functionality could lead to account takeover#223461 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 10 |
| Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register#225901 | Valid | Misconfiguration and Insecure Design | None | 2017-05-22 | – | 9 |
| Insecure Account Removal#223355 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 9 |
| Registration captcha bypass#223324 | Valid | Misconfiguration and Insecure Design | Medium | 2017-05-17 | – | 8 |
| Captcha Bypass at Email Reset can lead to Spamming users.#229541 | Valid | Misconfiguration and Insecure Design | – | 2017-06-02 | – | 7 |
| 2nd issue>>> flood of email no rate limit on delete account confirmation email >>#404713 | Valid | Misconfiguration and Insecure Design | Low | 2018-09-28 | – | 6 |
| Improper validation of unicode characters#242171 | Valid | Misconfiguration and Insecure Design | – | 2017-08-19 | – | 5 |
| Option method enabled#230194 | Valid | Misconfiguration and Insecure Design | None | 2017-05-21 | – | 5 |
| Spamming any user from Reset Password Function#223525 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 5 |
| [debian.weblate.org]-Missing SPF Record#245518 | Valid | Misconfiguration and Insecure Design | Low | 2017-08-24 | – | 4 |
| No filteration of null characters in name field#242945 | Valid | Misconfiguration and Insecure Design | None | 2017-07-27 | – | 4 |
| Content Spoofing in error message#223456 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 4 |
| HttpOnly Flag not set#224006 | Valid | Misconfiguration and Insecure Design | None | 2017-05-18 | – | 3 |
| ClickJacking on Debug#225555 | Valid | Misconfiguration and Insecure Design | – | 2017-06-16 | – | 2 |
| Specify maximal length in translation#224015 | Valid | Misconfiguration and Insecure Design | None | 2017-05-17 | – | 2 |
| Specify maximal length in new comment#223931 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 2 |
| Improper Password Reset Policy on https://hosted.weblate.org/#223362 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 2 |
| No rate limit or captcha to identify humans#257384 | Valid | Misconfiguration and Insecure Design | None | 2017-09-15 | – | 1 |
| CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org#231062 | Informative | Misconfiguration and Insecure Design | None | 2017-05-23 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.