Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
DisclosedAny year
WeaknessSQL Injection
- Any class
- Cross-site Scripting2,488
- Cross-Site Request Forgery511
- Open Redirect344
- Server-Side Request Forgery307
- SQL Injection315
- Command and Code Injection647
- Injection and Smuggling267
- Deserialization and Object Injection54
- File and Path Handling297
- Memory Corruption846
- Race Conditions45
- Denial of Service581
- Input Validation and Logic574
- Misconfiguration and Insecure Design1,027
- Supply Chain and Malicious Code10
- Cryptography500
- Information Disclosure1,758
- Authentication1,151
- Access Control1,347
- Insecure Direct Object Reference359
- Other weaknesses70
- No weakness recorded1,721
Access (title)Any
Access (analysis)Any
TechniqueAny
315 of 15,219 reports · $173,889 in bounties · 161 analysed so far
- #531051ValidAnalysedSQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseStarbucks · SQL Injection · 2019 · needs: no account · SQL injection–801votes
- #297478ValidAnalysedSQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentGSA Bounty · SQL Injection · 2019 · needs: no account · SQL injection–699votes
- #868436ValidTime-Based SQL injection at city-mobil.ruMail.ru · SQL Injection · 2020$15,000631votes
- #819738Not checked yetSQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameterRazer · SQL Injection$2,000580votes
- #811111Not checked yetSQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLogRazer · SQL Injection$2,000528votes
- #758654Not checked yetBlind SQL InjectionInnoGames · SQL Injection$2,000432votes
- #383127ValidAnalysedSQL Injection in report_xml.php through countryFilter[] parameterValve · SQL Injection · 2018 · needs: not clear from the report · SQL injection$25,000410votes
- #881901ValidSQL injection at fleet.city-mobil.ruMail.ru · SQL Injection · 2020$10,000372votes
- #786044Valid[windows10.hi-tech.mail.ru] Blind SQL InjectionMail.ru · SQL Injection · 2020$5,000330votes
- #403616ValidAnalysed[www.zomato.com] SQLi - /php/██████████ - item_idEternal · SQL Injection · 2018 · needs: not clear from the report · SQL injection$4,500326votes
- #761304ValidAnalysedSQL Injection on cookie parameterMTN Group · SQL Injection · 2020 · needs: not clear from the report · SQL injection–323votes
- #781205Not checked yetSQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour ParameterRazer · SQL Injection$2,000240votes
- #962889ValidSQL Injection in agent-managerAcronis · SQL Injection · 2021–237votes
- #592400ValidBlind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceStarbucks · SQL Injection · 2019 · no account (title)–236votes
- #894325Not checked yet[api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]Razer · SQL Injection$4,000232votes
- #745938ValidBoolean-based SQL Injection on relap.ioMail.ru · SQL Injection · 2020–227votes
- #711075ValidBlind SQL Injection in city-mobil.ru domainMail.ru · SQL Injection · 2020$2,000224votes
- #852306ValidSQL LIKE clauses wildcard injectionMail.ru · SQL Injection · 2020$8,000217votes
- #363815Not checked yetBlind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)Pornhub · SQL Injection–211votes
- #549355ValidBlind SQL Injection on starbucks.com.gt and WAF Bypass :*Starbucks · SQL Injection · 2019–210votes
- #273946Validwww.drivegrab.com SQL injectionGrab · SQL Injection · 2017$4,500205votes
- #2051931ValidBlind SQL injection on id.indrive.cominDrive · SQL Injection · 2023$4,134199votes
- #777693Not checked yetSQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid ParameterRazer · SQL Injection$2,000183votes
- #295841Not checked yetBlind SQL injection in Hall of FapPornhub · SQL Injection–179votes
- #435066ValidSQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterHackerOne · SQL Injection · 2018–174votes
- #1039315ValidSql injection on docs.atavist.comAutomattic · SQL Injection · 2020–170votes
- #1224660Validbypass sql injection #1109311Acronis · SQL Injection · 2021–164votes
- #818972ValidSQL Injection [unauthenticated] with direct output at https://news.mail.ru/Mail.ru · SQL Injection · 2020 · no account (title)$7,500156votes
- #2958619ValidSQLi | in URL pathsMTN Group · SQL Injection · 2025 · Critical–149votes
- #3578842ValidSQL Injection vulnerability found on ibm.com endpointIBM · SQL Injection · 2026 · Critical–137votes
- #952501ValidSolr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonEternal · SQL Injection · 2020$2,000137votes
- #1044698Valid[intensedebate.com] SQL Injection Time Based On /js/commentAction/Automattic · SQL Injection · 2021–130votes
- #3249794ValidSQL injection in structure pluginExpressionEngine · SQL Injection · 2026 · Medium–125votes
- #824307Not checked yetSQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.Razer · SQL Injection$2,000122votes
- #1525200ValidSQL Injection at https://files.palantir.com/ due to CVE-2021-38159Palantir Public · SQL Injection · 2022–121votes
- #768195Not checked yetSQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id ParameterRazer · SQL Injection$2,000119votes
- #923020ValidSQL injection on admin.acronis.host development web serviceAcronis · SQL Injection · 2021$250118votes
- #2633959ValidSQL injection in URL path leads to Database AccessMTN Group · SQL Injection · 2025 · Critical–115votes
- #1109311ValidSQL injection in https://www.acronis.cz/ via the log parameterAcronis · SQL Injection · 2021–103votes
- #1069561ValidSQL Injection intensedebate.comAutomattic · SQL Injection · 2021–102votes
- #3564655ValidComplete authentication bypass to admin permissionsRocket.Chat · SQL Injection · 2026 · Critical–100votes
- #3292573ValidSQL Injection when using FilteredRelationDjango · SQL Injection · 2025 · Critical–96votes
- #3198980ValidWoocommerce SQL Injection in WC_Report_Coupon_UsageAutomattic · SQL Injection · 2025 · Medium–96votes
- #2312334ValidTime based SQL injection at████████U.S. Dept Of Defense · SQL Injection · 2024–96votes
- #3395221ValidError-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0Revive Adserver · SQL Injection · 2025 · High–93votes
- #2209130ValidSQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscriptionMozilla · SQL Injection · 2024–93votes
- #795291Validturboslim.lady.mail.ru - Blind sql-injection.Mail.ru · SQL Injection · 2020$5,00093votes
- #150156ValidSQL Injection on sctrack.email.uber.com.cnUber · SQL Injection · 2016$4,00093votes
- #2737595ValidSQL InjectionU.S. Dept Of Defense · SQL Injection · 2024 · High–91votes
- #1893800ValidSQL Injection in CVE Discovery SearchHackerOne · SQL Injection · 2023–87votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.