Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:U.S. Dept Of Defense
Status
Severity
Weakness:SQL Injection
Clear
Year
Bounty paid0
Access stated
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters75 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Two Error-Based SQLi in courses.aspx on ██████████#227102ValidSQL Injection–2019-12-02––
SQL injection found in US Navy Website (http://███/)#197755ValidSQL Injection–2019-12-02–1
SQL Injection - https://███/█████████/MSI.portal#674838ValidSQL Injection–2020-05-14–1
SQL Injection vulnerability in a DoD website#197754ValidSQL Injection–2017-08-15–2
SQL Injection vulnerability in a DoD website#226211ValidSQL Injection–2017-08-15–3
████████ SQL#381771ValidSQL Injection–2019-10-08–3
Followup - SQL Injection - https://██████████/██████/MSI.portal#692326ValidSQL Injection–2020-05-14–3
Time Based SQL Injection vulnerability on a DoD website#188929ValidSQL Injection–2017-06-16–4
SQL Injection vulnerability in a DoD website#192079ValidSQL Injection–2017-06-23–4
SQL Injection vulnerability in a DoD website#192110ValidSQL Injection–2017-06-23–4
SQL injection vulnerability on a DoD website#193436ValidSQL Injection–2017-04-27–4
SQL injection vulnerability in a DoD website#195051ValidSQL Injection–2017-06-23–4
SQL injection on https://███████#214798ValidSQL Injection–2019-12-02–4
SQL Injection vulnerability in a DoD website#227587ValidSQL Injection–2017-08-15–4
Blind SQL Injection on DoD Site#242882ValidSQL Injection–2019-12-02–4
Code reversion allowing SQLI again in ███████#348047ValidSQL Injection–2019-10-08–4
SQL injection located in `███` in POST param `████████`#1262757ValidSQL InjectionHigh2021-09-09–4
SQL Injection vulnerability in a DoD website#201512ValidSQL Injection–2017-07-05–5
SQL injection vulnerability on a DoD website#202619ValidSQL Injection–2017-07-05–5
sql injection on /messagecenter/messagingcenter at https://www.███████/#381758ValidSQL Injection–2019-10-08–5
SQL Injection in the get_publications.php on the https://█████#489483ValidSQL Injection–2019-10-04–6
SQL INJECTION in https://████/██████████#723044ValidSQL Injection–2022-04-29–6
[████] SQL Injections on Referer Header exploitable via Time-Based method#1018621ValidSQL Injection–2020-11-02–6
Error-based blind SQL injection#3006666ValidSQL InjectionMedium2026-01-12–6
SQL Injection - data[account][id] parameter#3127152ValidSQL InjectionHigh2026-01-12–6
SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'#3127198ValidSQL InjectionHigh2026-01-12–6
SQL Injection - JSON 'name' parameter#3257171ValidSQL InjectionHigh2026-01-12–6
SQL injection vulnerability on a DoD website#189069ValidSQL Injection–2017-06-16–7
SQL injection vulnerability on a DoD website#193936ValidSQL Injection–2017-05-31–7
[████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)#648346ValidSQL Injection–2019-12-02–7
SQL Injection via URL#3127562ValidSQL InjectionHigh2026-01-12–7
SQLi in LASCO CME Query#186367Not checked yetSQL Injection–––8
[███] SQL injection & Reflected XSS#484801ValidSQL Injection–2019-12-02–8
SQL Injection in www.██████████#1015406ValidSQL Injection–2021-01-12–8
Time Based SQL Injection vulnerability on a DoD website#189851ValidSQL Injection–2017-07-05–9
Blind SQLi in a DoD Website#196300ValidSQL Injection–2017-06-14–9
SQLi on █████████#954667ValidSQL Injection–2021-07-29–9
Blind SQL Injection#771215ValidSQL Injection–2022-04-29–10
SQLi in login form of █████#982202ValidSQL Injection–2020-09-29–10
SQL Injection in █████#1489744ValidSQL InjectionCritical2022-04-07–10
SQL Injection in URI Path Leading to Full Database Disclosure on ████████#3234050ValidSQL InjectionHigh2026-01-12–10
SQL Injection vulnerability in a DoD website#216699ValidSQL Injection–2017-07-05–11
SQL Injection on https://████████/#232378ValidSQL Injection–2022-05-12–11
MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypass#577612ValidSQL Injection–2019-10-10–11
SQL injection on █████ due to tech.cfm#310031ValidSQL Injection–2019-10-08–12
SQL Injection in Login Page: https://█████/█████████/login.php#447742ValidSQL Injection–2020-05-14–12
SQL injections#272506ValidSQL Injection–2019-10-04–13
SQL injection vulnerability on a DoD website#189332ValidSQL Injection–2017-02-17–14
[SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter#1024984ValidSQL Injection–2020-11-23–14
Sql Injection At █████████#1723896ValidSQL InjectionMedium2023-01-06–14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.

Updated AboutDevelopersSign in