Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseAnalysed#531051 | Valid | Starbucks | SQL Injection | Critical | 2019-08-06 | – | 801 |
| SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentAnalysed#297478 | Valid | GSA Bounty | SQL Injection | Critical | 2019-03-22 | – | 699 |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceAnalysed#592400 | Valid | Starbucks | SQL Injection | Critical | 2019-07-22 | – | 236 |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :*Analysed#549355 | Valid | Starbucks | SQL Injection | High | 2019-06-19 | – | 210 |
| www.drivegrab.com SQL injectionAnalysed#273946 | Valid | Grab | SQL Injection | High | 2017-11-17 | $4,500 | 205 |
| Blind SQL injection on id.indrive.comAnalysed#2051931 | Valid | inDrive | SQL Injection | Critical | 2023-11-24 | $4,134 | 199 |
| SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterAnalysed#435066 | Valid | HackerOne | SQL Injection | Critical | 2018-11-30 | – | 174 |
| Sql injection on docs.atavist.comAnalysed#1039315 | Valid | Automattic | SQL Injection | High | 2020-12-08 | – | 170 |
| bypass sql injection #1109311Analysed#1224660 | Valid | Acronis | SQL Injection | Medium | 2021-10-05 | – | 164 |
| SQLi | in URL pathsAnalysed#2958619 | Valid | MTN Group | SQL Injection | Critical | 2025-03-06 | – | 149 |
| SQL Injection vulnerability found on ibm.com endpointAnalysed#3578842 | Valid | IBM | SQL Injection | Critical | 2026-03-12 | – | 137 |
| SQL Injection intensedebate.comAnalysed#1069561 | Valid | Automattic | SQL Injection | Medium | 2021-01-11 | – | 102 |
| Complete authentication bypass to admin permissionsAnalysed#3564655 | Valid | Rocket.Chat | SQL Injection | Critical | 2026-04-22 | – | 100 |
| Time based SQL injection at████████Analysed#2312334 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2024-01-26 | – | 96 |
| SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscriptionAnalysed#2209130 | Valid | Mozilla | SQL Injection | Critical | 2024-01-30 | – | 93 |
| SQL Injection on sctrack.email.uber.com.cnAnalysed#150156 | Valid | Uber | SQL Injection | – | 2016-07-25 | $4,000 | 93 |
| [SQLI ]Time Bassed Injection at ██████████ via referer headerAnalysed#995122 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2020-10-16 | – | 87 |
| Blind Sql Injection in https://████Analysed#2597543 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2024-08-29 | – | 81 |
| SQL Injection on www.██████████ on countID parameterAnalysed#390879 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-08 | – | 80 |
| Arbitrary SQL command injectionAnalysed#508487 | Valid | Nextcloud | SQL Injection | Critical | 2019-07-21 | – | 77 |
| SQL Injection at https://████ via ███ parameterAnalysed#1935151 | Valid | Sony | SQL Injection | Critical | 2023-04-24 | – | 74 |
| SQL Injection in ████Analysed#419017 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-08-19 | – | 73 |
| [https://reviews.zomato.com] Time Based SQL InjectionAnalysed#300176 | Valid | Eternal | SQL Injection | Critical | 2018-02-02 | $1,000 | 72 |
| Blind SQL injection at tsftp.informatica.comAnalysed#1034625 | Valid | Informatica | SQL Injection | Critical | 2020-11-16 | – | 68 |
| [www.zomato.com] Blind SQL Injection in /php/geto2bannerAnalysed#838855 | Valid | Eternal | SQL Injection | Critical | 2020-08-10 | $2,000 | 68 |
| Boolen Based Blind Sql Injection Via User Agent in ███.milAnalysed#2599826 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2025-01-24 | – | 67 |
| Unauthenticated SQL Injection at █████████ [HtUS]Analysed#1626226 | Valid | U.S. Dept Of Defense | SQL Injection | Critical | 2022-10-14 | – | 61 |
| Blind SQL injection in third-party software, that allows to reveal user statistic from rocket.chat and possibly hack into the rocketchat.agilecrm.comAnalysed#433792 | Valid | Rocket.Chat | SQL Injection | – | 2019-10-17 | – | 61 |
| [www.zomato.com] Blind SQL Injection in /php/widgets_handler.phpAnalysed#836079 | Valid | Eternal | SQL Injection | Critical | 2020-08-10 | $2,000 | 54 |
| SQL injection in https://demor.adr.acronis.com/ via the username parameterAnalysed#1436751 | Valid | Acronis | SQL Injection | High | 2024-08-28 | – | 49 |
| SQL Injection vulnerability located at ████████Analysed#384397 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-08-15 | – | 45 |
| Blind SQL InjectionAnalysed#1069531 | Valid | MTN Group | SQL Injection | Critical | 2021-08-14 | – | 43 |
| SQLi at █████ parameterAnalysed#3277276 | Valid | Mars | SQL Injection | Critical | 2026-02-24 | – | 42 |
| SQL injection in URL path processing on www.ibm.comAnalysed#1527284 | Valid | IBM | SQL Injection | Critical | 2022-05-06 | – | 35 |
| Time-based Blind SQLi on news.starbucks.comAnalysed#198292 | Valid | Starbucks | SQL Injection | High | 2017-02-24 | – | 35 |
| SQL injection on ██████████ via 'where' parameterAnalysed#2433970 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2024-05-03 | – | 34 |
| SQL Injection on the administrator panelAnalysed#865436 | Valid | MTN Group | SQL Injection | Critical | 2021-07-29 | – | 32 |
| SQL Injection on https://soa-accp.glbx.tva.gov/ via "/api/" path - VI-21-015Analysed#1125752 | Valid | Tennessee Valley Authority | SQL Injection | Critical | 2022-04-26 | – | 30 |
| SQL Injection through /include/findusers.phpAnalysed#1081145 | Valid | ImpressCMS | SQL Injection | Critical | 2022-10-06 | – | 30 |
| SOAP WSDL Parser SQL Code ExecutionAnalysed#390359 | Valid | U.S. Dept Of Defense | SQL Injection | Critical | 2019-01-16 | – | 30 |
| SQL injection at [https://█████████] [HtUS]Analysed#1627995 | Valid | U.S. Dept Of Defense | SQL Injection | Critical | 2022-09-14 | – | 29 |
| SQLI on desafio5estrelas.comAnalysed#476150 | Valid | Uber | SQL Injection | Medium | 2021-03-29 | $2,500 | 29 |
| SQL injectionAnalysed#311922 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2018-04-17 | – | 29 |
| [ipm.informatica.com] Sql injection OracleAnalysed#178057 | Valid | Informatica | SQL Injection | Critical | 2017-01-21 | – | 28 |
| SQL injection in partner id field on https://www.teavana.com (Sign-up form)Analysed#269279 | Valid | Starbucks | SQL Injection | Medium | 2018-01-23 | – | 27 |
| SQL injection on the https://████/Analysed#488795 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-04 | – | 23 |
| SQL Injection on [█████████]Analysed#1213207 | Valid | Sony | SQL Injection | High | 2022-12-07 | – | 22 |
| Information Disclosure in https://www.rockstargames.com/searchAnalysed#808832 | Valid | Rockstar Games | SQL Injection | Low | 2020-06-11 | – | 22 |
| [critical] sql injection by GET methodAnalysed#319279 | Valid | Khan Academy | SQL Injection | High | 2018-03-06 | – | 22 |
| gmmovinparts.com SQLi via forgot_password.jspAnalysed#109395 | Valid | General Motors | SQL Injection | – | 2016-08-30 | – | 22 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.