Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifierAnalysed#449351	Valid	Cross-site Scripting	Medium	2018-11-27	$2,500	156
Stored XSS in IE11 on hackerone.com via custom fieldsAnalysed#1173040	Valid	Cross-site Scripting	Medium	2021-06-24	–	146
HTML Injection in email via Name fieldAnalysed#1581499	Valid	Cross-site Scripting	Low	2022-09-18	$500	84
Potential stored Cross-Site Scripting vulnerability in Support BackendAnalysed#858894	Valid	Cross-site Scripting	Medium	2020-05-04	–	71
Stored XSS on https://events.hackerone.comAnalysed#1028332	Valid	Cross-site Scripting	None	2021-03-26	–	59
Stored Cross-Site Scripting vulnerability in example Custom Digital AgreementAnalysed#983077	Valid	Cross-site Scripting	Medium	2021-03-18	–	25
Improperly validated fields allows injection of arbitrary HTML via spoofed React objectsAnalysed#49652	Valid	Cross-site Scripting	High	2015-03-18	$5,000	23
HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome ExtensionAnalysed#1874260	Valid	Cross-site Scripting	Low	2023-02-14	–	21
Vulnerability with the way \ escaped characters in <http://danlec.com> style links are renderedAnalysed#46072	Valid	Cross-site Scripting	High	2015-02-03	$5,000	21

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.