Improper filtering of classes used in codeblocks in Markdown #12815 Valid Cross-site Scripting – 2014-07-08 – 5 Possible XSS #123278 Informative Cross-site Scripting – 2016-04-21 – 5 Send AJAX request to external domain #97191 Valid Cross-site Scripting – 2015-11-14 – 7 javascript: and mailto: links are allowed on users' profiles #4184 Valid Cross-site Scripting – 2015-05-13 – 8 Markdown parsing issue enables insertion of malicious tags and event handlers #46916 Valid Cross-site Scripting – 2015-04-07 $5,000 16 Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered #46072 Valid Cross-site Scripting – 2015-02-03 $5,000 21 HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension #1874260 Valid Cross-site Scripting Low 2023-02-14 – 21 Improperly validated fields allows injection of arbitrary HTML via spoofed React objects #49652 Valid Cross-site Scripting – 2015-03-18 $5,000 23 Self DOM-Based XSS in www.hackerone.com #406587 Valid Cross-site Scripting Low 2018-11-08 – 23 Stored Cross-Site Scripting vulnerability in example Custom Digital Agreement #983077 Valid Cross-site Scripting Medium 2021-03-18 – 25 Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml #1028396 Valid Cross-site Scripting None 2021-03-26 – 32 CSP not consistently applied #321 Valid Cross-site Scripting – 2013-11-30 – 34 IE 11 Self-XSS on Jira Integration Preview Base Link #212721 Valid Cross-site Scripting Low 2017-03-29 $750 42 (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation #171398 Valid Cross-site Scripting – 2016-10-27 – 44 Stored XSS on https://events.hackerone.com Analysed #1028332 Valid Cross-site Scripting None 2021-03-26 – 59 Query parameter reordering causes redirect page to render unsafe URL Analysed #293689 Valid Cross-site Scripting Medium 2017-11-30 $1,500 61 Potential stored Cross-Site Scripting vulnerability in Support Backend Analysed #858894 Valid Cross-site Scripting Medium 2020-05-04 – 71 Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter Analysed #2106708 Valid Cross-site Scripting Low 2023-08-22 – 80 Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com) Analysed #995995 Valid Cross-site Scripting None 2020-11-09 – 84 HTML Injection in email via Name field Analysed #1581499 Valid Cross-site Scripting Low 2022-09-18 $500 84 Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid} Analysed #1558010 Valid Cross-site Scripting High 2022-05-25 – 102 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting Low 2019-05-04 – 106 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget Analysed #1598347 Valid Cross-site Scripting Medium 2023-03-10 – 122 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting Medium 2018-08-04 – 129 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting Medium 2021-06-24 – 146 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting Medium 2018-11-27 $2,500 156 RXSS at image.hackerone.live via the `url` parameter Analysed #2035332 Valid Cross-site Scripting Low 2023-08-11 $500 171 Markdown parsing issue enables insertion of malicious tags and event handlers Analysed #299728 Valid Cross-site Scripting High 2018-01-29 $5,000 184 DOM Based XSS in www.hackerone.com via PostMessage Analysed #398054 Valid Cross-site Scripting Low 2019-02-21 $500 208 Reflected XSS on www.hackerone.com via Wistia embed code Analysed #986386 Valid Cross-site Scripting Low 2020-09-24 $500 236 Cross-site Scripting (XSS) on HackerOne careers page Analysed #474656 Valid Cross-site Scripting Low 2019-02-17 $500 239 Reflected XSS on www.hackerone.com and resources.hackerone.com Analysed #840759 Valid Cross-site Scripting Low 2020-05-05 $500 387