Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SQL Injection on sctrack.email.uber.com.cnAnalysed#150156 | Valid | Uber | SQL Injection | – | 2016-07-25 | $4,000 | 93 |
| Multiple vulnerabilities in a WordPress plugin at drive.uber.comAnalysed#135288 | Valid | Uber | SQL Injection | – | 2016-08-23 | – | 55 |
| SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)#181803 | No longer public | LocalTapiola | SQL Injection | – | 2016-12-08 | $1,350 | 50 |
| SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/Analysed#125932 | Valid | Uber | SQL Injection | – | 2016-06-14 | $3,000 | 39 |
| SQL Injection in sijoitustalous_peruutus (viestinta.lahitapiola.fi)#190434 | No longer public | LocalTapiola | SQL Injection | – | 2016-12-26 | – | 36 |
| SQL Injection on `/cs/Satellite` path#164739 | No longer public | LocalTapiola | SQL Injection | – | 2016-10-19 | – | 27 |
| gmmovinparts.com SQLi via forgot_password.jspAnalysed#109395 | Valid | General Motors | SQL Injection | – | 2016-08-30 | – | 22 |
| SQL Injection /webApp/sijoitustalous_peruutus locId parameter (viestinta.lahitapiola.fi)#181826 | No longer public | LocalTapiola | SQL Injection | – | 2016-12-08 | $350 | 15 |
| Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru]#141329 | No longer public | Mail.ru | SQL Injection | – | 2016-06-22 | – | 12 |
| [informatica.com] Blind SQL Injection#117073 | Valid | Informatica | SQL Injection | Critical | 2016-04-19 | – | 11 |
| Time-based sql-injection на https://puzzle.mail.ru#170149 | No longer public | Mail.ru | SQL Injection | – | 2016-11-15 | $300 | 9 |
| [townwars.mail.ru] Time-Based SQL Injection#144674 | No longer public | Mail.ru | SQL Injection | – | 2016-07-06 | $150 | 5 |
| SQLi in love.uber.com#125181 | Valid | Uber | SQL Injection | – | 2016-04-25 | – | 4 |
| vk.com/login.php#116764 | Valid | VK.com | SQL Injection | – | 2016-12-29 | – | 4 |
| SQL injection in conc/index.php/ccm/system/search/users/submit#38778 | Valid | Concrete CMS | SQL Injection | – | 2016-04-26 | – | 3 |
| [tidaltrek.mail.ru] SQL Injection#142479 | No longer public | Mail.ru | SQL Injection | – | 2016-09-16 | $150 | 2 |
| [orsotenslimselfie.lady.mail.ru] SQL Injection#115291 | No longer public | Mail.ru | SQL Injection | – | 2016-03-15 | $300 | 2 |
| Possible SQL injection on "Jump to twitter"#81701 | Valid | Gratipay | SQL Injection | Low | 2016-03-21 | – | 2 |
| Time Based SQL injection in url parameter#144359 | Informative | WebSummit | SQL Injection | – | 2016-06-27 | – | 1 |
| [tidaltrek.mail.ru] SQL Injection#140899 | No longer public | Mail.ru | SQL Injection | – | 2016-05-26 | $150 | 1 |
| SQL Injection#137956 | No longer public | Mail.ru | SQL Injection | – | 2016-05-26 | $150 | 1 |
| [3k.mail.ru] SQL Injection#116508 | No longer public | Mail.ru | SQL Injection | – | 2016-02-24 | $150 | 1 |
| Blind SQL INJ#115304 | N/A | Paragon Initiative Enterprises | SQL Injection | – | 2016-06-17 | – | 1 |
| [parapa.mail.ru] SQL Injection#109212 | No longer public | Mail.ru | SQL Injection | – | 2016-01-18 | $150 | 1 |
| Time-Based Blind SQL Injection Attacks#78443 | No longer public | Mail.ru | SQL Injection | – | 2016-03-10 | – | 1 |
| [afisha.mail.ru] SQL Injection#112555 | No longer public | Mail.ru | SQL Injection | – | 2016-02-01 | $300 | – |
| [cfire.mail.ru] Time Based SQL Injection#107780 | No longer public | Mail.ru | SQL Injection | – | 2016-01-15 | $150 | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.