Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Time based SQL injection at████████Analysed#2312334 | Valid | SQL Injection | High | 2024-01-26 | – | 96 |
| [SQLI ]Time Bassed Injection at ██████████ via referer headerAnalysed#995122 | Valid | SQL Injection | High | 2020-10-16 | – | 87 |
| Blind Sql Injection in https://████Analysed#2597543 | Valid | SQL Injection | Medium | 2024-08-29 | – | 81 |
| SQL Injection on www.██████████ on countID parameterAnalysed#390879 | Valid | SQL Injection | High | 2019-10-08 | – | 80 |
| SQL Injection in ████Analysed#419017 | Valid | SQL Injection | High | 2019-08-19 | – | 73 |
| Boolen Based Blind Sql Injection Via User Agent in ███.milAnalysed#2599826 | Valid | SQL Injection | Medium | 2025-01-24 | – | 67 |
| Unauthenticated SQL Injection at █████████ [HtUS]Analysed#1626226 | Valid | SQL Injection | Critical | 2022-10-14 | – | 61 |
| SQL Injection vulnerability located at ████████Analysed#384397 | Valid | SQL Injection | High | 2019-08-15 | – | 45 |
| SQL injection on ██████████ via 'where' parameterAnalysed#2433970 | Valid | SQL Injection | Medium | 2024-05-03 | – | 34 |
| SOAP WSDL Parser SQL Code ExecutionAnalysed#390359 | Valid | SQL Injection | Critical | 2019-01-16 | – | 30 |
| SQL injection at [https://█████████] [HtUS]Analysed#1627995 | Valid | SQL Injection | Critical | 2022-09-14 | – | 29 |
| SQL injectionAnalysed#311922 | Valid | SQL Injection | High | 2018-04-17 | – | 29 |
| SQL injection on the https://████/Analysed#488795 | Valid | SQL Injection | High | 2019-10-04 | – | 23 |
| SQL Injection on █████Analysed#277380 | Valid | SQL Injection | High | 2022-05-12 | – | 21 |
| time based SQL injection at [https://███] [HtUS]Analysed#1627970 | Valid | SQL Injection | Critical | 2022-09-14 | – | 20 |
| Blind SQL iNJECTIONAnalysed#1102591 | Valid | SQL Injection | Medium | 2021-06-03 | – | 19 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.