Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessSQL Injection
- Any class
- Cross-site Scripting49
- Cross-Site Request Forgery9
- Open Redirect3
- Server-Side Request Forgery3
- SQL Injection7
- Command and Code Injection11
- File and Path Handling1
- Memory Corruption1
- Denial of Service7
- Input Validation and Logic7
- Misconfiguration and Insecure Design17
- Cryptography6
- Information Disclosure44
- Authentication40
- Access Control11
- Insecure Direct Object Reference6
- No weakness recorded17
7 of 15,219 reports · $13,500 in bounties · 161 analysed so far
- #150156ValidSQL Injection on sctrack.email.uber.com.cnUber · SQL Injection · 2016$4,00093votes
- #206872ValidSQL injection in 3rd party software AnomaliUber · SQL Injection · 2017$2,50061votes
- #135288ValidMultiple vulnerabilities in a WordPress plugin at drive.uber.comUber · SQL Injection · 2016–55votes
- #361623ValidSQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partnersUber · SQL Injection · 2021$1,50043votes
- #125932ValidSQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/Uber · SQL Injection · 2016$3,00039votes
- #476150ValidSQLI on desafio5estrelas.comUber · SQL Injection · 2021$2,50029votes
- #125181ValidSQLi in love.uber.comUber · SQL Injection · 2016–4votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.