Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| XSS platform.twitter.com | video-js metadata#29360 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 1 |
| XSS vulnerability in video player page#15125 | Valid | Cross-site Scripting | – | 2014-08-02 | – | 2 |
| [Stored XSS] vine.co - profile page#36986 | Valid | Cross-site Scripting | – | 2015-03-26 | – | 2 |
| XSS platform.twitter.com#29328 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 3 |
| XSS in fabric.io#32519 | Valid | Cross-site Scripting | – | 2014-12-23 | – | 3 |
| DOM Cross-Site Scripting ( XSS )#33091 | Valid | Cross-site Scripting | – | 2014-12-03 | $1,400 | 3 |
| Twitter Card - Parent Window Redirection#46818 | Valid | Cross-site Scripting | – | 2015-05-04 | $560 | 3 |
| Redirect URL in /intent/ functionality is not properly escaped#48516 | Valid | Cross-site Scripting | – | 2015-02-24 | – | 3 |
| XSS ON MOPUB.COM#15356 | Valid | Cross-site Scripting | – | 2014-08-15 | – | 4 |
| ads.twitter.com xss#27511 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 4 |
| Stored xss#27846 | Valid | Cross-site Scripting | – | 2014-09-27 | – | 4 |
| XSS in twitter.com/safety/unsafe_link_warning#53098 | Valid | Cross-site Scripting | – | 2015-04-03 | $1,400 | 4 |
| xss in DM group name in twitter#129436 | Valid | Cross-site Scripting | – | 2016-04-22 | – | 4 |
| XSS via Fabrico Account Name#34725 | Valid | Cross-site Scripting | – | 2016-07-11 | – | 5 |
| HTML/XSS rendered in Android App of Crashlytics through fabric.io#41856 | Valid | Cross-site Scripting | – | 2015-02-18 | – | 5 |
| XSS in original referrer after follow#50134 | Valid | Cross-site Scripting | – | 2015-03-09 | – | 5 |
| Tweet Deck XSS- Persistent- Group DM name#119022 | Valid | Cross-site Scripting | – | 2016-03-04 | – | 5 |
| XSS in the "Poll" Feature on Twitter.com#95231 | Valid | Cross-site Scripting | – | 2016-08-12 | – | 6 |
| Cross site scripting on ads.twitter.com#28150 | Valid | Cross-site Scripting | – | 2014-10-16 | – | 7 |
| [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME#218451 | Valid | Cross-site Scripting | Medium | 2017-05-08 | – | 11 |
| Html Injection and Possible XSS via MathML#502926 | Duplicate | Cross-site Scripting | Critical | 2019-09-03 | – | 13 |
| xss in link items (mopub.com)#100931 | Valid | Cross-site Scripting | – | 2016-07-05 | $560 | 14 |
| XSS using javascript:alert(8007)#127154 | Valid | Cross-site Scripting | Low | 2016-11-28 | – | 15 |
| Stored XSS in https://app.mopub.comAnalysed#642281 | Valid | Cross-site Scripting | Medium | 2019-12-17 | – | 21 |
| XSS on OAuth authorize/authenticate endpointAnalysed#87040 | Valid | Cross-site Scripting | – | 2015-11-20 | – | 23 |
| File Upload XSS in image uploading of App in mopubAnalysed#97672 | Valid | Cross-site Scripting | – | 2016-08-25 | – | 24 |
| CRLF and XSS stored on ton.twitter.comAnalysed#191380 | Valid | Cross-site Scripting | – | 2017-07-05 | $1,680 | 32 |
| Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506Analysed#906433 | Valid | Cross-site Scripting | High | 2020-09-24 | $560 | 32 |
| Cross-site scripting (reflected)Analysed#176754 | Valid | Cross-site Scripting | Medium | 2016-12-09 | – | 45 |
| URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWSAnalysed#32825 | Valid | Cross-site Scripting | – | 2014-11-03 | – | 50 |
| DOMXSS in TweetdeckAnalysed#119471 | Valid | Cross-site Scripting | – | 2017-04-02 | – | 50 |
| csp bypass + xssAnalysed#153666 | Valid | Cross-site Scripting | – | 2017-07-05 | – | 51 |
| Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)Analysed#275518 | Valid | Cross-site Scripting | High | 2018-02-17 | – | 63 |
| Multiple DOMXSS on Amplify Web PlayerAnalysed#88719 | Valid | Cross-site Scripting | – | 2017-04-15 | – | 66 |
| Multiple XSS on account settings that can hijack any users in the company.Analysed#503298 | Valid | Cross-site Scripting | Critical | 2019-04-01 | $700 | 73 |
| Html Injection and Possible XSS in sms-be-vip.twitter.comAnalysed#150179 | Valid | Cross-site Scripting | – | 2016-08-28 | – | 83 |
| Persistent DOM-based XSS in https://help.twitter.com via localStorage#297968 | Valid | Cross-site Scripting | Medium | 2018-02-24 | – | 84 |
| Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive dataAnalysed#1369674 | Valid | Cross-site Scripting | Critical | 2022-02-12 | – | 99 |
| XSS via referrer parameterAnalysed#867616 | Valid | Cross-site Scripting | Medium | 2020-10-26 | – | 124 |
| Reflected XSS in twitterflightschool.comAnalysed#770349 | Valid | Cross-site Scripting | None | 2020-02-21 | – | 140 |
| XSS and cache poisoning via upload.twitter.com on ton.twitter.comAnalysed#84601 | Valid | Cross-site Scripting | – | 2019-05-01 | – | 198 |
| Account Takeover in Periscope TVAnalysed#317476 | Valid | Cross-site Scripting | High | 2018-09-06 | – | 213 |
| Stored XSS on reports.Analysed#485748 | Valid | Cross-site Scripting | High | 2019-04-01 | $700 | 232 |
| XSS via Direct Message deeplinksAnalysed#341908 | Valid | Cross-site Scripting | – | 2019-05-09 | – | 236 |
| Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040 | Valid | Cross-site Scripting | Critical | 2021-07-09 | – | 357 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.