Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessCross-Site Request Forgery
- Any class
- Cross-site Scripting35
- Cross-Site Request Forgery6
- Open Redirect3
- Server-Side Request Forgery1
- SQL Injection1
- Command and Code Injection1
- Injection and Smuggling1
- File and Path Handling3
- Denial of Service2
- Input Validation and Logic2
- Misconfiguration and Insecure Design9
- Cryptography2
- Information Disclosure6
- Authentication1
- Access Control15
- No weakness recorded8
6 of 15,219 reports · 227 analysed so far
- #428019ValidCSRF to HTML Injection in CommentsWordPress · Cross-Site Request Forgery · 2019–95votes
- #881855ValidArbitrary change of blog's background image via CSRFWordPress · Cross-Site Request Forgery · 2020–21votes
- #187520ValidWordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-authWordPress · Cross-Site Request Forgery · 2017–21votes
- #149589ValidCSRF to add admin [wordpress]WordPress · Cross-Site Request Forgery · 2017–15votes
- #914232N/ACSRF on comment postWordPress · Cross-Site Request Forgery · 2020–5votes
- #836187ValidCSRF in Profile Fields allows deleting any field in BuddyPressWordPress · Cross-Site Request Forgery · 2020–5votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.