Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Time based SQL injection at████████Analysed#2312334 | Valid | SQL Injection | High | 2024-01-26 | – | 96 |
| SQL InjectionAnalysed#2737595 | Valid | SQL Injection | High | 2024-10-25 | – | 91 |
| [SQLI ]Time Bassed Injection at ██████████ via referer headerAnalysed#995122 | Valid | SQL Injection | High | 2020-10-16 | – | 87 |
| Blind Sql Injection in https://████#2597543 | Valid | SQL Injection | Medium | 2024-08-29 | – | 81 |
| SQL Injection on www.██████████ on countID parameter#390879 | Valid | SQL Injection | – | 2019-10-08 | – | 80 |
| SQL Injection in ████#419017 | Valid | SQL Injection | – | 2019-08-19 | – | 73 |
| Boolen Based Blind Sql Injection Via User Agent in ███.mil#2599826 | Valid | SQL Injection | Medium | 2025-01-24 | – | 67 |
| Unauthenticated SQL Injection at █████████ [HtUS]#1626226 | Valid | SQL Injection | Critical | 2022-10-14 | – | 61 |
| Time-based blind SQL injection#2759243 | Valid | SQL Injection | Medium | 2025-01-24 | – | 53 |
| SQL Injection in ████#519631 | Valid | SQL Injection | – | 2019-08-19 | – | 49 |
| SQL Injection vulnerability located at ████████#384397 | Valid | SQL Injection | – | 2019-08-15 | – | 45 |
| Blind Sql Injection https:/████████#2020429 | Valid | SQL Injection | Medium | 2023-06-30 | – | 39 |
| SQL injection on ██████████ via 'where' parameter#2433970 | Valid | SQL Injection | Medium | 2024-05-03 | – | 34 |
| SQL Injection at https://████████.asp (█████████) [selMajcom] [HtUS]#1628408 | Valid | SQL Injection | Critical | 2023-01-06 | – | 30 |
| SOAP WSDL Parser SQL Code Execution#390359 | Valid | SQL Injection | – | 2019-01-16 | – | 30 |
| SQL injection at [https://█████████] [HtUS]#1627995 | Valid | SQL Injection | Critical | 2022-09-14 | – | 29 |
| SQL injection#311922 | Valid | SQL Injection | – | 2018-04-17 | – | 29 |
| SQL Injection in the `move_papers.php` on the https://██████████#491191 | Valid | SQL Injection | – | 2020-06-25 | – | 26 |
| SQL injection on the https://████/#488795 | Valid | SQL Injection | – | 2019-10-04 | – | 23 |
| SQL Injection on █████#277380 | Valid | SQL Injection | – | 2022-05-12 | – | 21 |
| time based SQL injection at [https://███] [HtUS]#1627970 | Valid | SQL Injection | Critical | 2022-09-14 | – | 20 |
| Blind SQL iNJECTION#1102591 | Valid | SQL Injection | Medium | 2021-06-03 | – | 19 |
| SQL injection at [█████████] [HtUS]#1626198 | Valid | SQL Injection | Critical | 2022-09-14 | – | 17 |
| SQL injection vulnerability on a DoD website#200623 | Valid | SQL Injection | – | 2017-03-16 | – | 17 |
| Blind SQL injection on ████████#313037 | Valid | SQL Injection | – | 2019-10-08 | – | 15 |
| Sql Injection At █████████#1723896 | Valid | SQL Injection | Medium | 2023-01-06 | – | 14 |
| [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter#1024984 | Valid | SQL Injection | High | 2020-11-23 | – | 14 |
| SQL injection vulnerability on a DoD website#189332 | Valid | SQL Injection | – | 2017-02-17 | – | 14 |
| SQL injections#272506 | Valid | SQL Injection | – | 2019-10-04 | – | 13 |
| SQL Injection in Login Page: https://█████/█████████/login.php#447742 | Valid | SQL Injection | – | 2020-05-14 | – | 12 |
| SQL injection on █████ due to tech.cfm#310031 | Valid | SQL Injection | – | 2019-10-08 | – | 12 |
| MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypass#577612 | Valid | SQL Injection | – | 2019-10-10 | – | 11 |
| SQL Injection on https://████████/#232378 | Valid | SQL Injection | – | 2022-05-12 | – | 11 |
| SQL Injection vulnerability in a DoD website#216699 | Valid | SQL Injection | – | 2017-07-05 | – | 11 |
| SQL Injection in URI Path Leading to Full Database Disclosure on ████████#3234050 | Valid | SQL Injection | High | 2026-01-12 | – | 10 |
| SQL Injection in █████#1489744 | Valid | SQL Injection | Critical | 2022-04-07 | – | 10 |
| SQLi in login form of █████#982202 | Valid | SQL Injection | Critical | 2020-09-29 | – | 10 |
| Blind SQL Injection#771215 | Valid | SQL Injection | – | 2022-04-29 | – | 10 |
| SQLi on █████████#954667 | Valid | SQL Injection | High | 2021-07-29 | – | 9 |
| Blind SQLi in a DoD Website#196300 | Valid | SQL Injection | – | 2017-06-14 | – | 9 |
| Time Based SQL Injection vulnerability on a DoD website#189851 | Valid | SQL Injection | – | 2017-07-05 | – | 9 |
| SQL Injection in www.██████████#1015406 | Valid | SQL Injection | High | 2021-01-12 | – | 8 |
| [███] SQL injection & Reflected XSS#484801 | Valid | SQL Injection | – | 2019-12-02 | – | 8 |
| SQLi in LASCO CME Query#186367 | Not checked yet | SQL Injection | – | – | – | 8 |
| SQL Injection via URL#3127562 | Valid | SQL Injection | High | 2026-01-12 | – | 7 |
| [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)#648346 | Valid | SQL Injection | – | 2019-12-02 | – | 7 |
| SQL injection vulnerability on a DoD website#193936 | Valid | SQL Injection | – | 2017-05-31 | – | 7 |
| SQL injection vulnerability on a DoD website#189069 | Valid | SQL Injection | – | 2017-06-16 | – | 7 |
| SQL Injection - JSON 'name' parameter#3257171 | Valid | SQL Injection | High | 2026-01-12 | – | 6 |
| SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'#3127198 | Valid | SQL Injection | High | 2026-01-12 | – | 6 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (965 analysed so far), which can be wrong. Data as of 2026-11-14.