Reports Programs Subdomains Program Status: Not checked yet Severity Weakness: SQL Injection Bounty paid11 Access stated No account 0 A user account 0 Admin or privileged 0 No option matches.
Access needed No account 0 A user account 0 A privileged role 0 Admin 0 Physical or local access 0 Not clear from the report 0 No option matches.
Clear filters 20 of 15,219 reports Disclosed bug bounty reports Report Status Program Weakness Severity Disclosed Bounty Votes Possible SQL injection can cause denial of service attack #123660 No longer public Dropbox SQL Injection – – – 2 CTF Writeup #507023 No longer public 50m-ctf SQL Injection – – – 5 Weak credentials, Blind SQLi, Timing attack, that leads to web admin access #514584 No longer public 50m-ctf SQL Injection – – – 7 [Android API] SQL injection ( errortoken.json ) #204050 No longer public Pornhub SQL Injection – – – 8 [api.easy2pay.co] SQL Injection in cashcard via card_no parameter ⭐️Bypassing IP whitelist⭐️ #894329 No longer public Razer SQL Injection – – – 14 https://zest.co.th/zestlinepay/checkproduct API endpoint suffers from Boolean-based SQL injection #783147 No longer public Razer SQL Injection – – – 15 SQL Injection at /displayPDF.php (printshop.engelvoelkers.com) #914427 No longer public Engel & Völkers Technology GmbH SQL Injection – – – 19 Time Based SQL-inject in post-parametr login[username] [domain - youporn.com] #203935 No longer public Pornhub SQL Injection – – $2,500 30 Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id] #789259 No longer public Razer SQL Injection – – $1,000 68 Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameter #790914 No longer public Razer SQL Injection – – $1,000 80 SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id Parameter #768195 No longer public Razer SQL Injection – – $2,000 119 SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter. #824307 No longer public Razer SQL Injection – – $2,000 122 Blind SQL injection in Hall of Fap #295841 No longer public Pornhub SQL Injection – – – 179 SQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid Parameter #777693 No longer public Razer SQL Injection – – $2,000 183 Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues) #363815 No longer public Pornhub SQL Injection – – – 211 [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥] #894325 No longer public Razer SQL Injection – – $4,000 232 SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter #781205 No longer public Razer SQL Injection – – $2,000 240 Blind SQL Injection #758654 No longer public InnoGames SQL Injection – – $2,000 432 SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLog #811111 No longer public Razer SQL Injection – – $2,000 528 SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameter #819738 No longer public Razer SQL Injection – – $2,000 580
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.