Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Complete authentication bypass to admin permissionsAnalysed#3564655 | Valid | Rocket.Chat | SQL Injection | Critical | 2026-04-22 | – | 100 |
| SQL Injection intensedebate.comAnalysed#1069561 | Valid | Automattic | SQL Injection | – | 2021-01-11 | – | 102 |
| SQL Injection vulnerability found on ibm.com endpointAnalysed#3578842 | Valid | IBM | SQL Injection | Critical | 2026-03-12 | – | 137 |
| SQLi | in URL pathsAnalysed#2958619 | Valid | MTN Group | SQL Injection | Critical | 2025-03-06 | – | 149 |
| bypass sql injection #1109311Analysed#1224660 | Valid | Acronis | SQL Injection | Medium | 2021-10-05 | – | 164 |
| Sql injection on docs.atavist.comAnalysed#1039315 | Valid | Automattic | SQL Injection | – | 2020-12-08 | – | 170 |
| SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterAnalysed#435066 | Valid | HackerOne | SQL Injection | – | 2018-11-30 | – | 174 |
| Blind SQL injection on id.indrive.comAnalysed#2051931 | Valid | inDrive | SQL Injection | Critical | 2023-11-24 | $4,134 | 199 |
| www.drivegrab.com SQL injectionAnalysed#273946 | Valid | Grab | SQL Injection | – | 2017-11-17 | $4,500 | 205 |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :*Analysed#549355 | Valid | Starbucks | SQL Injection | – | 2019-06-19 | – | 210 |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceAnalysed#592400 | Valid | Starbucks | SQL Injection | – | 2019-07-22 | – | 236 |
| SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentAnalysed#297478 | Valid | GSA Bounty | SQL Injection | – | 2019-03-22 | – | 699 |
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseAnalysed#531051 | Valid | Starbucks | SQL Injection | – | 2019-08-06 | – | 801 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.