Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL injection on https://███████#214798 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 4 |
| SQL Injection vulnerability in a DoD website#227587 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-08-15 | – | 4 |
| Blind SQL Injection on DoD Site#242882 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 4 |
| Code reversion allowing SQLI again in ███████#348047 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-08 | – | 4 |
| SQL injection in Serendipity (serendipity_fetchComments)#374748 | Valid | Hanno's projects | SQL Injection | High | 2018-11-09 | – | 4 |
| Дайте swag#665688 | Valid | VK.com | SQL Injection | None | 2019-09-18 | – | 4 |
| SQL injection located in `███` in POST param `████████`#1262757 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2021-09-09 | – | 4 |
| blind sql on [ https://argocd.upchieve.org/login?return_url=id= ]#1278928 | N/A | UPchieve | SQL Injection | Critical | 2021-07-28 | – | 4 |
| Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL#3890329 | Valid | MariaDB | SQL Injection | Medium | 2026-11-04 | – | 4 |
| Yahoo YQL Injection?#1407 | No longer public | Yahoo! | SQL Injection | – | 2014-03-22 | – | 5 |
| SQL Injection ON HK.Promotion#3039 | No longer public | Yahoo! | SQL Injection | – | 2014-03-17 | – | 5 |
| [parapa.mail.ru] SQL Injection reapet#114086 | No longer public | Mail.ru | SQL Injection | – | 2020-04-01 | $150 | 5 |
| [townwars.mail.ru] Time-Based SQL Injection#144674 | No longer public | Mail.ru | SQL Injection | – | 2016-07-06 | $150 | 5 |
| SQL Injection vulnerability in a DoD website#201512 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-07-05 | – | 5 |
| SQL injection vulnerability on a DoD website#202619 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-07-05 | – | 5 |
| sql injection vulnerablity found#211988 | N/A | Legal Robot | SQL Injection | None | 2017-10-13 | – | 5 |
| sql injection on /messagecenter/messagingcenter at https://www.███████/#381758 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-08 | – | 5 |
| sql#453297 | No longer public | Mail.ru | SQL Injection | – | 2019-06-03 | – | 5 |
| CTF Writeup#507023 | No longer public | 50m-ctf | SQL Injection | – | – | – | 5 |
| blind sql on [selfcare.mtn.com.af]#925007 | Valid | MTN Group | SQL Injection | Medium | 2021-09-09 | – | 5 |
| tmgame.mail.ru - Blind sql injection#943487 | No longer public | Mail.ru | SQL Injection | – | 2021-11-06 | $250 | 5 |
| CTF Writeup#1066233 | Valid | h1-ctf | SQL Injection | Critical | 2021-01-14 | – | 5 |
| `SHOW [CREATE|GRANTS] ...` / `mariadb-dump` Unescaped SQL Generation#3848978 | Valid | MariaDB | SQL Injection | – | 2026-10-07 | – | 5 |
| SQLi on http://sports.yahoo.com/nfl/draft#1538 | No longer public | Yahoo! | SQL Injection | – | 2014-04-05 | – | 6 |
| [express-cart] Customer and admin email enumeration through MongoDB injection#397445 | Valid | Node.js third-party modules | SQL Injection | High | 2018-09-10 | – | 6 |
| SQL Injection in the get_publications.php on the https://█████#489483 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-04 | – | 6 |
| [CRITICAL] Sql Injection on http://axa.dxi.eu#722145 | Valid | 8x8 | SQL Injection | Critical | 2020-06-09 | – | 6 |
| SQL INJECTION in https://████/██████████#723044 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2022-04-29 | – | 6 |
| [████] SQL Injections on Referer Header exploitable via Time-Based method#1018621 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2020-11-02 | – | 6 |
| ccc.h1ctf.com CTF#1215919 | Valid | h1-ctf | SQL Injection | Critical | 2021-06-18 | – | 6 |
| Error-based blind SQL injection#3006666 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2026-01-12 | – | 6 |
| SQL Injection - data[account][id] parameter#3127152 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2026-01-12 | – | 6 |
| SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'#3127198 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2026-01-12 | – | 6 |
| SQL Injection - JSON 'name' parameter#3257171 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2026-01-12 | – | 6 |
| [cfire.mail.ru] Time Based SQL Injection 2#111003 | No longer public | Mail.ru | SQL Injection | – | 2020-04-01 | $200 | 7 |
| SQL injection vulnerability on a DoD website#189069 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-06-16 | – | 7 |
| SQL injection vulnerability on a DoD website#193936 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2017-05-31 | – | 7 |
| Weak credentials, Blind SQLi, Timing attack, that leads to web admin access#514584 | No longer public | 50m-ctf | SQL Injection | – | – | – | 7 |
| [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)#648346 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 7 |
| Taking Grinch Down To Save Holidays#1067037 | Valid | h1-ctf | SQL Injection | Critical | 2021-01-22 | – | 7 |
| SQL Injection via URL#3127562 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2026-01-12 | – | 7 |
| SQLi in LASCO CME Query#186367 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2026-01-12 | – | 8 |
| SQL Injection on /webApp/viivanalle (viestinta.lahitapiola.fi)#200210 | No longer public | LocalTapiola | SQL Injection | – | 2017-02-10 | – | 8 |
| Sql injection on /webApp/sijoituswebinaari (viestinta.lahitapiola.fi)#200212 | No longer public | LocalTapiola | SQL Injection | – | 2017-02-10 | – | 8 |
| SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi)#200214 | No longer public | LocalTapiola | SQL Injection | – | 2017-02-10 | – | 8 |
| [Android API] SQL injection ( errortoken.json )#204050 | No longer public | Pornhub | SQL Injection | – | – | – | 8 |
| [███] SQL injection & Reflected XSS#484801 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 8 |
| SQL Injection or Denial of Service due to a Prototype Pollution#869574 | Valid | Node.js third-party modules | SQL Injection | Critical | 2020-07-24 | – | 8 |
| SQL injection at /admin.php?/cp/members/create#968240 | Valid | ExpressionEngine | SQL Injection | Medium | 2022-02-01 | – | 8 |
| SQL Injection leads to retrieve the contents of an entire database.#1002641 | Duplicate | BlockDev Sp. Z o.o | SQL Injection | Critical | 2021-12-29 | – | 8 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.