Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| [cfire.mail.ru] Time Based SQL Injection#107780 | Valid | Mail.ru | SQL Injection | – | 2016-01-15 | $150 | – |
| [afisha.mail.ru] SQL Injection#112555 | Valid | Mail.ru | SQL Injection | – | 2016-02-01 | $300 | – |
| Two Error-Based SQLi in courses.aspx on ██████████#227102 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2019-12-02 | – | – |
| First CTF ever!#1069263 | Valid | h1-ctf | SQL Injection | Critical | 2021-01-12 | – | – |
| SQL injection [дырка в движке форума]#9919 | Valid | Mail.ru | SQL Injection | – | 2014-11-16 | $200 | 1 |
| Time based sql injection#9921 | Valid | Mail.ru | SQL Injection | – | 2014-12-10 | $200 | 1 |
| SQL Injection Vulnerability in Concrete5 version 5.7.3.1#59664 | Valid | Concrete CMS | SQL Injection | – | 2015-06-11 | – | 1 |
| Time-Based Blind SQL Injection Attacks#78443 | Valid | Mail.ru | SQL Injection | – | 2016-03-10 | – | 1 |
| [parapa.mail.ru] SQL Injection#109212 | Valid | Mail.ru | SQL Injection | – | 2016-01-18 | $150 | 1 |
| [3k.mail.ru] SQL Injection#116508 | Valid | Mail.ru | SQL Injection | – | 2016-02-24 | $150 | 1 |
| SQL Injection#137956 | Valid | Mail.ru | SQL Injection | – | 2016-05-26 | $150 | 1 |
| [tidaltrek.mail.ru] SQL Injection#140899 | Valid | Mail.ru | SQL Injection | – | 2016-05-26 | $150 | 1 |
| SQL injection found in US Navy Website (http://███/)#197755 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2019-12-02 | – | 1 |
| typeorm does not properly escape parameters when building SQL queries, resulting in potential SQLi#319458 | Valid | Node.js third-party modules | SQL Injection | Medium | 2019-04-03 | – | 1 |
| [increments] sql injection#508346 | Valid | Node.js third-party modules | SQL Injection | High | 2020-02-02 | – | 1 |
| SQL Injection - https://███/█████████/MSI.portal#674838 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2020-05-14 | – | 1 |
| SQL inj#10468 | Valid | Mail.ru | SQL Injection | – | 2014-09-12 | $150 | 2 |
| SQL injection, time zoom script, tile ID#17227 | Valid | Uzbey | SQL Injection | – | 2014-07-18 | – | 2 |
| store-agent.mail.ru: stacked blind injection#60420 | Valid | Mail.ru | SQL Injection | – | 2015-09-13 | $400 | 2 |
| Possible SQL injection on "Jump to twitter"#81701 | Valid | Gratipay | SQL Injection | – | 2016-03-21 | – | 2 |
| [orsotenslimselfie.lady.mail.ru] SQL Injection#115291 | Valid | Mail.ru | SQL Injection | – | 2016-03-15 | $300 | 2 |
| [tidaltrek.mail.ru] SQL Injection#142479 | Valid | Mail.ru | SQL Injection | – | 2016-09-16 | $150 | 2 |
| SQL Injection vulnerability in a DoD website#197754 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-08-15 | – | 2 |
| `sql` does not properly escape parameters when building SQL queries, resulting in potential SQLi#319465 | Valid | Node.js third-party modules | SQL Injection | Medium | 2018-05-12 | – | 2 |
| [@azhou/basemodel] SQL injection#506644 | Valid | Node.js third-party modules | SQL Injection | High | 2020-02-02 | – | 2 |
| Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhere#3891779 | Valid | MariaDB | SQL Injection | Medium | 2026-11-04 | – | 2 |
| SQL inj#10037 | Valid | Mail.ru | SQL Injection | – | 2014-05-30 | $150 | 3 |
| SQL#10081 | Valid | Mail.ru | SQL Injection | – | 2014-08-16 | $150 | 3 |
| SQL injection update.mail.ru#11861 | Valid | Mail.ru | SQL Injection | – | 2014-05-30 | $250 | 3 |
| SQL Injection on 11x11.mail.ru#15762 | Valid | Mail.ru | SQL Injection | – | 2014-09-16 | – | 3 |
| SQL injection in conc/index.php/ccm/system/search/users/submit#38778 | Valid | Concrete CMS | SQL Injection | – | 2016-04-26 | – | 3 |
| [https://www.anghami.com/updatemailinfo/] Sql Injection#86468 | Valid | Anghami | SQL Injection | – | 2015-10-02 | – | 3 |
| SQL Injection vulnerability in a DoD website#226211 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-08-15 | – | 3 |
| ████████ SQL#381771 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-08 | – | 3 |
| Followup - SQL Injection - https://██████████/██████/MSI.portal#692326 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2020-05-14 | – | 3 |
| SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server#922567 | Valid | 8x8 | SQL Injection | High | 2020-07-29 | – | 3 |
| Connector/C++ string escaper re-escapes its own output, enabling SQL injection#3890289 | Valid | MariaDB | SQL Injection | Medium | 2026-11-04 | – | 3 |
| caesary.yahoo.net Blind Sql Injection#21899 | Valid | Yahoo! | SQL Injection | – | 2014-08-20 | – | 4 |
| SQL Injection#23014 | Valid | Uzbey | SQL Injection | – | 2014-11-02 | – | 4 |
| vk.com/login.php#116764 | Valid | VK.com | SQL Injection | – | 2016-12-29 | – | 4 |
| SQLi in love.uber.com#125181 | Valid | Uber | SQL Injection | – | 2016-04-25 | – | 4 |
| Time Based SQL Injection vulnerability on a DoD website#188929 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-06-16 | – | 4 |
| SQL Injection vulnerability in a DoD website#192079 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-06-23 | – | 4 |
| SQL Injection vulnerability in a DoD website#192110 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-06-23 | – | 4 |
| SQL injection vulnerability on a DoD website#193436 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-04-27 | – | 4 |
| SQL injection vulnerability in a DoD website#195051 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-06-23 | – | 4 |
| SQL injection on https://███████#214798 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2019-12-02 | – | 4 |
| SQL Injection vulnerability in a DoD website#227587 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2017-08-15 | – | 4 |
| Blind SQL Injection on DoD Site#242882 | Valid | U.S. Dept Of Defense | SQL Injection | – | 2019-12-02 | – | 4 |
| Code reversion allowing SQLI again in ███████#348047 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-08 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.