Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessFile and Path Handling
- Any class
- Cross-site Scripting35
- Cross-Site Request Forgery6
- Open Redirect3
- Server-Side Request Forgery1
- SQL Injection1
- Command and Code Injection1
- Injection and Smuggling1
- File and Path Handling3
- Denial of Service2
- Input Validation and Logic2
- Misconfiguration and Insecure Design9
- Cryptography2
- Information Disclosure6
- Authentication1
- Access Control15
- No weakness recorded8
3 of 15,219 reports · 161 analysed so far
- #436928ValidRCE as Admin defeats WordPress hardening and file permissionsWordPress · File and Path Handling · 2020–164votes
- #3931777ValidAuthor → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`WordPress · File and Path Handling · 2026 · Critical–48votes
- #291878ValidArbitrary file deletion in wp-core - guides towards RCE and information disclosureWordPress · File and Path Handling · 2018–17votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.