Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127 | Valid | Valve | SQL Injection | – | 2018-07-27 | $25,000 | 410 |
| [www.zomato.com] SQLi - /php/██████████ - item_idAnalysed#403616 | Valid | Eternal | SQL Injection | – | 2018-09-11 | $4,500 | 326 |
| SQL Injection on cookie parameterAnalysed#761304 | Valid | MTN Group | SQL Injection | – | 2020-05-03 | – | 323 |
| SQL Injection in agent-managerAnalysed#962889 | Valid | Acronis | SQL Injection | – | 2021-08-16 | – | 237 |
| Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonAnalysed#952501 | Valid | Eternal | SQL Injection | – | 2020-08-10 | $2,000 | 137 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.