Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
7 of 15,219 reports · 227 analysed so far
- #3578842ValidSQL Injection vulnerability found on ibm.com endpointIBM · SQL Injection · 2026 · Critical–137votes
- #1355817ValidSQL Injection in IBM access control panel & Broken access in admin panelIBM · SQL Injection · 2021–54votes
- #1567516Validsql injection via https://setup.p2p.ihost.com/IBM · SQL Injection · 2022–41votes
- #3730301ValidSQL Injection vulnerability found on IBM.com subdomainIBM · SQL Injection · 2026–36votes
- #1527284ValidSQL injection in URL path processing on www.ibm.comIBM · SQL Injection · 2022–35votes
- #3662095ValidSQL Injection found on ibm.com subdomainIBM · SQL Injection · 2026 · Critical–33votes
- #703819ValidSQL Injection and plaintext passwords via User SearchIBM · SQL Injection · 2022–11votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.