Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Reflected XSS in Step 2 of the Installation#170156 | Valid | Cross-site Scripting | – | 2017-08-02 | – | 6 |
| Reflected XSS on Zones > Invocation Code#178611 | Valid | Cross-site Scripting | Low | 2017-08-02 | – | 7 |
| Reflected XSS on /admin/campaign-zone-zones.php#1097979 | Valid | Cross-site Scripting | Medium | 2021-03-16 | – | 7 |
| Reflected XSS on /admin/stats.php#1097217 | Valid | Cross-site Scripting | Medium | 2021-03-16 | – | 9 |
| Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser#3680090 | Valid | Cross-site Scripting | None | 2026-06-03 | – | 9 |
| Stored XSS on Admin Access Page - Email field#173501 | Valid | Cross-site Scripting | High | 2017-08-02 | – | 10 |
| Reflected XSS on /admin/stats.php#1187820 | Valid | Cross-site Scripting | Medium | 2021-06-03 | – | 12 |
| Reflected XSS in stats‑video.php via improperly encoded URL parameters#3793243 | Valid | Cross-site Scripting | Medium | 2026-06-25 | – | 12 |
| Reflected XSS on www/delivery/afr.php#775693 | Valid | Cross-site Scripting | Medium | 2020-01-21 | – | 16 |
| Reflected XSS on /www/delivery/afr.php (bypass of report #775693)#986365 | Valid | Cross-site Scripting | Medium | 2021-01-19 | – | 16 |
| Stored XSS on inventory-retrieve.php#3399809 | Valid | Cross-site Scripting | Low | 2025-11-19 | – | 17 |
| Reflected XSS in /admin/banner-zone.php (v6.0.0+)Analysed#3403727 | Valid | Cross-site Scripting | Medium | 2025-11-19 | – | 18 |
| Reflected XSS on /admin/userlog-index.phpAnalysed#1083231 | Valid | Cross-site Scripting | Medium | 2021-01-26 | – | 20 |
| Reflected XSS in account-preferences-plugin.phpAnalysed#3399191 | Valid | Cross-site Scripting | Medium | 2025-11-19 | – | 21 |
| Stored-XSS in Banner Name fieldAnalysed#3404968 | Valid | Cross-site Scripting | Low | 2025-11-19 | – | 21 |
| Stored XSS via Full Name field in userlog email entriesAnalysed#3669623 | Valid | Cross-site Scripting | Medium | 2026-06-03 | – | 21 |
| Reflected XSS on /admin/stats.phpAnalysed#1083376 | Valid | Cross-site Scripting | Medium | 2021-01-26 | – | 24 |
| Stored XSS in maintenance tools via unescaped entity namesAnalysed#3781311 | Valid | Cross-site Scripting | Medium | 2026-06-25 | – | 25 |
| Reflected XSS via clientid parameter in zone‑include.phpAnalysed#3653316 | Valid | Cross-site Scripting | Medium | 2026-06-03 | – | 26 |
| Stored XSS in Conversion Statistics via Tracker NameAnalysed#3400506 | Valid | Cross-site Scripting | High | 2025-11-19 | – | 28 |
| Reflected XSS via unsanitised refresh parameter in zone invocation tagAnalysed#3780806 | Valid | Cross-site Scripting | Medium | 2026-06-25 | – | 29 |
| Stored-XSS in campaign name displayed in Banners modalAnalysed#3411750 | Valid | Cross-site Scripting | Medium | 2025-11-19 | – | 32 |
| Reflected XSS in afr.phpAnalysed#3468169 | Valid | Cross-site Scripting | Medium | 2026-01-14 | – | 36 |
| [revive-adserver] Reflected XSS in Banner Delivery Options via cap parameterAnalysed#3473696 | Valid | Cross-site Scripting | Medium | 2026-01-14 | – | 37 |
| Reflected XSS in banner-acl.php and channel-acl.php via executionorderAnalysed#3470970 | Valid | Cross-site Scripting | Medium | 2026-01-14 | – | 39 |
| Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2Analysed#3091390 | Valid | Cross-site Scripting | Medium | 2025-10-22 | – | 49 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.