Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseAnalysed#531051 | Valid | Starbucks | SQL Injection | Critical | 2019-08-06 | – | 801 |
| SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentAnalysed#297478 | Valid | GSA Bounty | SQL Injection | Critical | 2019-03-22 | – | 699 |
| Time-Based SQL injection at city-mobil.ru#868436 | No longer public | Mail.ru | SQL Injection | – | 2020-06-17 | $15,000 | 631 |
| SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127 | Valid | Valve | SQL Injection | Critical | 2018-07-27 | $25,000 | 410 |
| SQL injection at fleet.city-mobil.ru#881901 | No longer public | Mail.ru | SQL Injection | – | 2020-09-03 | $10,000 | 372 |
| [windows10.hi-tech.mail.ru] Blind SQL Injection#786044 | No longer public | Mail.ru | SQL Injection | – | 2020-03-10 | $5,000 | 330 |
| [www.zomato.com] SQLi - /php/██████████ - item_idAnalysed#403616 | Valid | Eternal | SQL Injection | Critical | 2018-09-11 | $4,500 | 326 |
| SQL Injection on cookie parameterAnalysed#761304 | Valid | MTN Group | SQL Injection | High | 2020-05-03 | – | 323 |
| SQL Injection in agent-managerAnalysed#962889 | Valid | Acronis | SQL Injection | High | 2021-08-16 | – | 237 |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceAnalysed#592400 | Valid | Starbucks | SQL Injection | Critical | 2019-07-22 | – | 236 |
| Boolean-based SQL Injection on relap.io#745938 | No longer public | Mail.ru | SQL Injection | – | 2020-01-22 | – | 227 |
| Blind SQL Injection in city-mobil.ru domain#711075 | No longer public | Mail.ru | SQL Injection | – | 2020-01-29 | $2,000 | 224 |
| SQL LIKE clauses wildcard injection#852306 | No longer public | Mail.ru | SQL Injection | – | 2020-10-31 | $8,000 | 217 |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :*Analysed#549355 | Valid | Starbucks | SQL Injection | High | 2019-06-19 | – | 210 |
| www.drivegrab.com SQL injectionAnalysed#273946 | Valid | Grab | SQL Injection | – | 2017-11-17 | $4,500 | 205 |
| Blind SQL injection on id.indrive.comAnalysed#2051931 | Valid | inDrive | SQL Injection | Critical | 2023-11-24 | $4,134 | 199 |
| SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterAnalysed#435066 | Valid | HackerOne | SQL Injection | Critical | 2018-11-30 | – | 174 |
| Sql injection on docs.atavist.comAnalysed#1039315 | Valid | Automattic | SQL Injection | High | 2020-12-08 | – | 170 |
| bypass sql injection #1109311Analysed#1224660 | Valid | Acronis | SQL Injection | Medium | 2021-10-05 | – | 164 |
| SQL Injection [unauthenticated] with direct output at https://news.mail.ru/#818972 | No longer public | Mail.ru | SQL Injection | – | 2020-10-30 | $7,500 | 156 |
| SQLi | in URL pathsAnalysed#2958619 | Valid | MTN Group | SQL Injection | Critical | 2025-03-06 | – | 149 |
| SQL Injection vulnerability found on ibm.com endpointAnalysed#3578842 | Valid | IBM | SQL Injection | Critical | 2026-03-12 | – | 137 |
| Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonAnalysed#952501 | Valid | Eternal | SQL Injection | Critical | 2020-08-10 | $2,000 | 137 |
| [intensedebate.com] SQL Injection Time Based On /js/commentAction/Analysed#1044698 | Valid | Automattic | SQL Injection | Critical | 2021-01-01 | – | 130 |
| SQL injection in structure pluginAnalysed#3249794 | Valid | ExpressionEngine | SQL Injection | Medium | 2026-01-26 | – | 125 |
| SQL Injection at https://files.palantir.com/ due to CVE-2021-38159Analysed#1525200 | Valid | Palantir Public | SQL Injection | High | 2022-04-05 | – | 121 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | Valid | Acronis | SQL Injection | High | 2021-06-22 | $250 | 118 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | Valid | MTN Group | SQL Injection | Critical | 2025-01-08 | – | 115 |
| SQL injection in https://www.acronis.cz/ via the log parameterAnalysed#1109311 | Valid | Acronis | SQL Injection | Medium | 2021-06-11 | – | 103 |
| SQL Injection intensedebate.comAnalysed#1069561 | Valid | Automattic | SQL Injection | Medium | 2021-01-11 | – | 102 |
| Complete authentication bypass to admin permissionsAnalysed#3564655 | Valid | Rocket.Chat | SQL Injection | Critical | 2026-04-22 | – | 100 |
| SQL Injection when using FilteredRelationAnalysed#3292573 | Valid | Django | SQL Injection | Critical | 2025-09-15 | – | 96 |
| Woocommerce SQL Injection in WC_Report_Coupon_UsageAnalysed#3198980 | Valid | Automattic | SQL Injection | Medium | 2025-06-24 | – | 96 |
| Time based SQL injection at████████Analysed#2312334 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2024-01-26 | – | 96 |
| Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0Analysed#3395221 | Valid | Revive Adserver | SQL Injection | High | 2025-10-24 | – | 93 |
| SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscriptionAnalysed#2209130 | Valid | Mozilla | SQL Injection | Critical | 2024-01-30 | – | 93 |
| turboslim.lady.mail.ru - Blind sql-injection.#795291 | No longer public | Mail.ru | SQL Injection | – | 2020-03-10 | $5,000 | 93 |
| SQL Injection on sctrack.email.uber.com.cnAnalysed#150156 | Valid | Uber | SQL Injection | – | 2016-07-25 | $4,000 | 93 |
| SQL InjectionAnalysed#2737595 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2024-10-25 | – | 91 |
| SQL Injection in CVE Discovery SearchAnalysed#1893800 | Valid | HackerOne | SQL Injection | High | 2023-03-06 | – | 87 |
| [SQLI ]Time Bassed Injection at ██████████ via referer headerAnalysed#995122 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2020-10-16 | – | 87 |
| SQL injection on jd.mail.ru#365011 | No longer public | Mail.ru | SQL Injection | – | 2021-09-08 | $300 | 87 |
| 3igames.mail.ru SQL Injection#790005 | No longer public | Mail.ru | SQL Injection | – | 2020-04-06 | $1,500 | 86 |
| Blind Sql Injection in https://████Analysed#2597543 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2024-08-29 | – | 81 |
| SQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionAnalysed#3462991 | Valid | Nextcloud | SQL Injection | High | 2026-05-15 | – | 80 |
| [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.phpAnalysed#1042746 | Valid | Automattic | SQL Injection | Critical | 2021-01-01 | – | 80 |
| SQL Injection on www.██████████ on countID parameterAnalysed#390879 | Valid | U.S. Dept Of Defense | SQL Injection | High | 2019-10-08 | – | 80 |
| SQL Injection in Django ORM via Unvalidated `_connector` in Q ObjectsAnalysed#3335709 | Valid | Django | SQL Injection | Critical | 2025-11-06 | – | 77 |
| Arbitrary SQL command injectionAnalysed#508487 | Valid | Nextcloud | SQL Injection | Critical | 2019-07-21 | – | 77 |
| SQL injection delivery-club.ru (ClickHouse)#1024773 | No longer public | Mail.ru | SQL Injection | – | 2021-03-18 | $5,000 | 76 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.