Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| CSRF to add admin [wordpress]Analysed#149589 | Valid | WordPress | Cross-Site Request Forgery | – | 2017-06-30 | – | 15 |
| CSRF в виджетахAnalysed#1091296 | Valid | VK.com | Cross-Site Request Forgery | None | 2021-11-05 | $100 | 15 |
| Проверяем принадлеженость email и номера телефона к определенному юзеру / CSRF на смену номера для некоторых пользователейAnalysed#388236 | Valid | VK.com | Cross-Site Request Forgery | High | 2019-01-28 | $300 | 16 |
| Уязвимость дает возможность смотреть кто лайкал приватным фото или видеоAnalysed#92113 | Valid | VK.com | Cross-Site Request Forgery | Low | 2018-06-24 | $100 | 17 |
| [https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On RailsAnalysed#1400309 | Valid | Shopify | Cross-Site Request Forgery | None | 2022-04-16 | – | 17 |
| Уязвимость дает возможность видеть записи , которые предлагаются пабликам + ещеAnalysed#106179 | Valid | VK.com | Cross-Site Request Forgery | Low | 2018-06-30 | $300 | 19 |
| Sensitive information/action is stored/done is done using a GET requestAnalysed#163820 | Valid | Khan Academy | Cross-Site Request Forgery | – | 2019-06-23 | – | 20 |
| Information disclosure - emails disclosed in response > staging.seatme.usAnalysed#49170 | Valid | Yelp | Cross-Site Request Forgery | – | 2017-05-11 | – | 21 |
| CSRF на установку своей почты к аккаунту.Analysed#301586 | Valid | VK.com | Cross-Site Request Forgery | Critical | 2021-05-23 | – | 23 |
| User In The Same Center Can Create CSRF To Change The Information About BusinessAnalysed#1006306 | Valid | TikTok | Cross-Site Request Forgery | Low | 2020-12-18 | $147 | 23 |
| CSRF on TikTok Ads PortalAnalysed#1087436 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2021-05-26 | $1,000 | 23 |
| Arbitrary comment content change with GET CSRF.Analysed#1096115 | Valid | ExpressionEngine | Cross-Site Request Forgery | Low | 2024-05-28 | – | 27 |
| CSRF to Cross-site Scripting (XSS)Analysed#1118501 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2021-03-24 | – | 27 |
| Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/articleAnalysed#790465 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2020-06-24 | – | 29 |
| No CSRF protection when adding an item to cartAnalysed#2190062 | Valid | Mars | Cross-Site Request Forgery | Low | 2024-01-30 | – | 29 |
| CSRF на загрузку аудиозаписейAnalysed#329345 | Valid | VK.com | Cross-Site Request Forgery | Medium | 2021-11-05 | $100 | 30 |
| Cross-Site Request Forgery (CSRF)Analysed#157993 | Valid | Instacart | Cross-Site Request Forgery | – | 2016-10-13 | – | 33 |
| HackerOne reports escalation to JIRA is CSRF vulnerableAnalysed#226418 | Valid | HackerOne | Cross-Site Request Forgery | Medium | 2017-08-30 | $500 | 36 |
| CSRF in seller-us.tiktok.com/profile/account-setting/delegation-loginAnalysed#2002352 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2023-07-26 | – | 41 |
| [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.Analysed#201326 | Valid | Uber | Cross-Site Request Forgery | Critical | 2023-03-23 | $2,000 | 50 |
| [Admin Panel] CSRF to resume/pause runnerAnalysed#415238 | Valid | GitLab | Cross-Site Request Forgery | Low | 2020-12-01 | – | 60 |
| Client-Side Path Traversal on LINE Developers ConsoleAnalysed#2473862 | Valid | LY Corporation | Cross-Site Request Forgery | Medium | 2024-09-26 | – | 61 |
| CSRF protection on OIDC login is brokenAnalysed#1878381 | Valid | Nextcloud | Cross-Site Request Forgery | Medium | 2023-04-04 | $500 | 77 |
| [CRITICAL] Full account takeover using CSRFAnalysed#235642 | Valid | X / xAI | Cross-Site Request Forgery | High | 2017-11-03 | – | 88 |
| CSRF to HTML Injection in CommentsAnalysed#428019 | Valid | WordPress | Cross-Site Request Forgery | High | 2019-05-13 | – | 95 |
| CSRF Account TakeoverAnalysed#1253462 | Valid | TikTok | Cross-Site Request Forgery | High | 2022-08-16 | – | 95 |
| CSRF on connecting Paypal as Payment ProviderAnalysed#807924 | Valid | Shopify | Cross-Site Request Forgery | Medium | 2020-04-10 | – | 304 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | TikTok | Cross-Site Request Forgery | High | 2020-12-15 | – | 366 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.