Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127 | Valid | Valve | SQL Injection | Critical | 2018-07-27 | $25,000 | 410 |
| [www.zomato.com] SQLi - /php/██████████ - item_idAnalysed#403616 | Valid | Eternal | SQL Injection | Critical | 2018-09-11 | $4,500 | 326 |
| SQL Injection on cookie parameterAnalysed#761304 | Valid | MTN Group | SQL Injection | High | 2020-05-03 | – | 323 |
| SQL Injection in agent-managerAnalysed#962889 | Valid | Acronis | SQL Injection | High | 2021-08-16 | – | 237 |
| Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonAnalysed#952501 | Valid | Eternal | SQL Injection | Critical | 2020-08-10 | $2,000 | 137 |
| SQL Injection at https://files.palantir.com/ due to CVE-2021-38159Analysed#1525200 | Valid | Palantir Public | SQL Injection | High | 2022-04-05 | – | 121 |
| SQL injection in https://www.acronis.cz/ via the log parameterAnalysed#1109311 | Valid | Acronis | SQL Injection | Medium | 2021-06-11 | – | 103 |
| SQL InjectionAnalysed#2737595 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2024-10-25 | – | 91 |
| SQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionAnalysed#3462991 | Valid | Nextcloud | SQL Injection | High | 2026-05-15 | – | 80 |
| [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.phpAnalysed#1042746 | Valid | Automattic | SQL Injection | Critical | 2021-01-01 | – | 80 |
| sqli on █████████ search functionalityAnalysed#2446550 | Valid | Mars | SQL Injection | Medium | 2024-06-25 | – | 72 |
| Time Based SQL InjectionAnalysed#1878584 | Valid | U.S. Department of State | SQL Injection | Critical | 2023-04-20 | – | 64 |
| SQL injection at ███████Analysed#2256032 | Valid | Sony | SQL Injection | Critical | 2024-01-24 | – | 63 |
| [www.zomato.com] SQLi on `order_id` parameterAnalysed#358669 | Valid | Eternal | SQL Injection | Critical | 2018-05-30 | $1,000 | 63 |
| SQLi At `███████` via `theme_name`Analysed#3293803 | Valid | Mars | SQL Injection | Critical | 2026-02-24 | – | 62 |
| CVE-2024-53908: Django Potential SQL injection in `HasKey(lhs, rhs)` on OracleAnalysed#2882887 | Valid | Internet Bug Bounty | SQL Injection | High | 2025-02-07 | – | 61 |
| [www.zomato.com] Union SQLi + Waf BypassAnalysed#258582 | Valid | Eternal | SQL Injection | – | 2017-09-19 | $1,000 | 61 |
| SQL injection in 3rd party software AnomaliAnalysed#206872 | Valid | Uber | SQL Injection | High | 2017-03-21 | $2,500 | 61 |
| Time-base SQL Injection in Search UsersAnalysed#876800 | Valid | Concrete CMS | SQL Injection | Medium | 2020-08-05 | – | 60 |
| SQL Injection in IBM access control panel & Broken access in admin panelAnalysed#1355817 | Valid | IBM | SQL Injection | Critical | 2021-10-18 | – | 54 |
| Time-based blind SQL injectionAnalysed#2759243 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2025-01-24 | – | 53 |
| Sqli on ██████ search functionalityAnalysed#2453475 | Valid | Mars | SQL Injection | Medium | 2024-06-25 | – | 47 |
| SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partnersAnalysed#361623 | Valid | Uber | SQL Injection | High | 2021-03-15 | $1,500 | 43 |
| sql injection via https://setup.p2p.ihost.com/Analysed#1567516 | Valid | IBM | SQL Injection | Critical | 2022-06-17 | – | 41 |
| SQL injection in /errors/viewbuild/Analysed#690349 | Valid | Valve | SQL Injection | Critical | 2024-07-30 | – | 41 |
| [www.zomato.com] Boolean SQLi - /█████.phpAnalysed#297534 | Valid | Eternal | SQL Injection | – | 2018-03-29 | $1,000 | 41 |
| Blind Sql Injection https:/████████Analysed#2020429 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2023-06-30 | – | 39 |
| SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/Analysed#125932 | Valid | Uber | SQL Injection | – | 2016-06-14 | $3,000 | 39 |
| SQL Injection vulnerability found on IBM.com subdomainAnalysed#3730301 | Valid | IBM | SQL Injection | – | 2026-10-16 | – | 36 |
| [www.zomato.com] Boolean SQLi - /███████.phpAnalysed#301257 | Valid | Eternal | SQL Injection | – | 2018-03-29 | $1,000 | 35 |
| SQL Injection found on ibm.com subdomainAnalysed#3662095 | Valid | IBM | SQL Injection | Critical | 2026-10-12 | – | 33 |
| sqliAnalysed#207695 | Valid | Ubiquiti Inc. | SQL Injection | Critical | 2017-03-31 | – | 33 |
| Blind SQL Injection on █████ via URI PathAnalysed#2266081 | Valid | Mars | SQL Injection | Critical | 2024-02-14 | – | 29 |
| SQL Injection in the `move_papers.php` on the https://██████████Analysed#491191 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2020-06-25 | – | 26 |
| H1-CTF 100k Solution - Congratz on the 100k Rep todayisnewAnalysed#1216408 | Valid | h1-ctf | SQL Injection | Critical | 2021-06-17 | – | 25 |
| Saving Christmas from Grinchy GodsAnalysed#1434017 | Valid | h1-ctf | SQL Injection | Critical | 2022-02-01 | – | 20 |
| SQL Injection, exploitable in boolean modeAnalysed#246412 | Valid | Eternal | SQL Injection | Critical | 2017-07-19 | – | 20 |
| WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosureAnalysed#179920 | Valid | WordPress | SQL Injection | Critical | 2017-11-13 | – | 17 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.