Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL injection in structure pluginAnalysed#3249794 | Valid | ExpressionEngine | SQL Injection | Medium | 2026-01-26 | – | 125 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | Valid | Acronis | SQL Injection | High | 2021-06-22 | $250 | 118 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.