Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | Valid | SQL Injection | – | 2020-05-03 | – | 323 |
| SQLi | in URL paths#2958619 | Valid | SQL Injection | Critical | 2025-03-06 | – | 149 |
| SQL injection in URL path leads to Database Access#2633959 | Valid | SQL Injection | Critical | 2025-01-08 | – | 115 |
| Blind SQL Injection#1069531 | Valid | SQL Injection | – | 2021-08-14 | – | 43 |
| SQL Injection on the administrator panel#865436 | Valid | SQL Injection | – | 2021-07-29 | – | 32 |
| SQL injection [futexpert.mtngbissau.com]#924855 | Valid | SQL Injection | – | 2021-09-09 | – | 9 |
| blind sql on [selfcare.mtn.com.af]#925007 | Valid | SQL Injection | – | 2021-09-09 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.