Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| bypass sql injection #1109311Analysed#1224660 | Valid | Acronis | SQL Injection | Medium | 2021-10-05 | – | 164 |
| SQL injection in structure pluginAnalysed#3249794 | Valid | ExpressionEngine | SQL Injection | Medium | 2026-01-26 | – | 125 |
| SQL injection in https://www.acronis.cz/ via the log parameterAnalysed#1109311 | Valid | Acronis | SQL Injection | Medium | 2021-06-11 | – | 103 |
| SQL Injection intensedebate.comAnalysed#1069561 | Valid | Automattic | SQL Injection | Medium | 2021-01-11 | – | 102 |
| Woocommerce SQL Injection in WC_Report_Coupon_UsageAnalysed#3198980 | Valid | Automattic | SQL Injection | Medium | 2025-06-24 | – | 96 |
| Blind Sql Injection in https://████Analysed#2597543 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2024-08-29 | – | 81 |
| sqli on █████████ search functionalityAnalysed#2446550 | Valid | Mars | SQL Injection | Medium | 2024-06-25 | – | 72 |
| Boolen Based Blind Sql Injection Via User Agent in ███.milAnalysed#2599826 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2025-01-24 | – | 67 |
| Time-base SQL Injection in Search UsersAnalysed#876800 | Valid | Concrete CMS | SQL Injection | Medium | 2020-08-05 | – | 60 |
| Time-based blind SQL injectionAnalysed#2759243 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2025-01-24 | – | 53 |
| Sqli on ██████ search functionalityAnalysed#2453475 | Valid | Mars | SQL Injection | Medium | 2024-06-25 | – | 47 |
| Blind Sql Injection https:/████████Analysed#2020429 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2023-06-30 | – | 39 |
| SQL injection on ██████████ via 'where' parameterAnalysed#2433970 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2024-05-03 | – | 34 |
| SQLI on desafio5estrelas.comAnalysed#476150 | Valid | Uber | SQL Injection | Medium | 2021-03-29 | $2,500 | 29 |
| SQL injection in partner id field on https://www.teavana.com (Sign-up form)Analysed#269279 | Valid | Starbucks | SQL Injection | Medium | 2018-01-23 | – | 27 |
| SQL Injection in parameter REPORT#269347 | Informative | Tor | SQL Injection | Medium | 2023-11-28 | – | 23 |
| Blind SQL iNJECTIONAnalysed#1102591 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2021-06-03 | – | 19 |
| [Informational] Possible SQL Injection in inc/ajax-actions-frontend.php#310280 | Valid | MapsMarker.com e.U. | SQL Injection | Medium | 2018-06-17 | – | 15 |
| Sql Injection At █████████#1723896 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2023-01-06 | – | 14 |
| SQL injection vulnerability on a DoD website#189332 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-02-17 | – | 14 |
| GitHub Security Lab (GHSL) Vulnerability Report: SQLInjection in FileContentProvider.kt (GHSL-2022-059)#1650264 | Valid | ownCloud | SQL Injection | Medium | 2023-04-12 | $300 | 12 |
| stripo blog search SQL Injection#761382 | Valid | Stripo Inc | SQL Injection | Medium | 2020-01-30 | – | 12 |
| Blind SQL Injection#771215 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2022-04-29 | – | 10 |
| Blind SQLi in a DoD Website#196300 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-06-14 | – | 9 |
| Time Based SQL Injection vulnerability on a DoD website#189851 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-07-05 | – | 9 |
| SQL injection at /admin.php?/cp/members/create#968240 | Valid | ExpressionEngine | SQL Injection | Medium | 2022-02-01 | – | 8 |
| [███] SQL injection & Reflected XSS#484801 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 8 |
| [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)#648346 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 7 |
| SQL injection vulnerability on a DoD website#189069 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-06-16 | – | 7 |
| Error-based blind SQL injection#3006666 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2026-01-12 | – | 6 |
| SQL INJECTION in https://████/██████████#723044 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2022-04-29 | – | 6 |
| blind sql on [selfcare.mtn.com.af]#925007 | Valid | MTN Group | SQL Injection | Medium | 2021-09-09 | – | 5 |
| SQL injection vulnerability on a DoD website#202619 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-07-05 | – | 5 |
| SQL Injection vulnerability in a DoD website#201512 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-07-05 | – | 5 |
| Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL#3890329 | Valid | MariaDB | SQL Injection | Medium | 2026-11-04 | – | 4 |
| Blind SQL Injection on DoD Site#242882 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 4 |
| SQL Injection vulnerability in a DoD website#227587 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-08-15 | – | 4 |
| SQL injection on https://███████#214798 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 4 |
| SQL injection vulnerability in a DoD website#195051 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-06-23 | – | 4 |
| SQL injection vulnerability on a DoD website#193436 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-04-27 | – | 4 |
| Time Based SQL Injection vulnerability on a DoD website#188929 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-06-16 | – | 4 |
| Connector/C++ string escaper re-escapes its own output, enabling SQL injection#3890289 | Valid | MariaDB | SQL Injection | Medium | 2026-11-04 | – | 3 |
| SQL Injection vulnerability in a DoD website#226211 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-08-15 | – | 3 |
| Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhere#3891779 | Valid | MariaDB | SQL Injection | Medium | 2026-11-04 | – | 2 |
| `sql` does not properly escape parameters when building SQL queries, resulting in potential SQLi#319465 | Valid | Node.js third-party modules | SQL Injection | Medium | 2018-05-12 | – | 2 |
| SQL Injection vulnerability in a DoD website#197754 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2017-08-15 | – | 2 |
| SQL Injection - https://███/█████████/MSI.portal#674838 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2020-05-14 | – | 1 |
| typeorm does not properly escape parameters when building SQL queries, resulting in potential SQLi#319458 | Valid | Node.js third-party modules | SQL Injection | Medium | 2019-04-03 | – | 1 |
| SQL injection found in US Navy Website (http://███/)#197755 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 1 |
| Two Error-Based SQLi in courses.aspx on ██████████#227102 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.