Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Reflected xss in https://sh.reddit.comAnalysed#1549206 | Valid | Cross-site Scripting | – | 2022-05-08 | $5,000 | 166 | |
| Total Paid Bounty Paid can be discloseAnalysed#674757 | Valid | HackerOne | Information Disclosure | – | 2020-02-28 | $500 | 168 |
| Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackAnalysed#531032 | Valid | Slack | Cryptography | – | 2020-03-12 | $2,000 | 170 |
| Sql injection on docs.atavist.comAnalysed#1039315 | Valid | Automattic | SQL Injection | – | 2020-12-08 | – | 170 |
| DOM Based XSS via postMessage at https://inventory.upserve.com/login/Analysed#603764 | Valid | Upserve | Cross-site Scripting | – | 2019-06-25 | $2,500 | 171 |
| Open Redirect in Logout & LoginAnalysed#1788006 | Valid | Expedia Group Bug Bounty | Open Redirect | – | 2023-03-02 | – | 171 |
| RXSS at image.hackerone.live via the `url` parameterAnalysed#2035332 | Valid | HackerOne | Cross-site Scripting | – | 2023-08-11 | $500 | 171 |
| Account Takeover via Authentication Bypass in TikTok Account RecoveryAnalysed#2443228 | Valid | TikTok | Authentication | Critical | 2024-07-13 | $12,000 | 172 |
| 404-response contains debug-information with all headersAnalysed#792998 | Valid | HackerOne | Information Disclosure | – | 2020-05-16 | – | 173 |
| SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterAnalysed#435066 | Valid | HackerOne | SQL Injection | – | 2018-11-30 | – | 174 |
| XSS at https://exchangemarketplace.com/blogsearchAnalysed#1145162 | Valid | Shopify | Cross-site Scripting | – | 2021-04-09 | – | 174 |
| Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsAnalysed#815085 | Valid | HackerOne | Misconfiguration and Insecure Design | – | 2024-02-04 | $3,750 | 176 |
| Access token stealing.Analysed#821896 | Valid | PlayStation | Access Control | – | 2020-11-21 | $1,200 | 177 |
| Information Disclosure through Sentry Instance ███████Analysed#697512 | Valid | Eternal | Information Disclosure | – | 2019-09-19 | $750 | 178 |
| Disclosure of `payment_transactions` for programs via GraphQL queryAnalysed#707433 | Valid | HackerOne | Information Disclosure | – | 2019-12-01 | – | 178 |
| Open redirect at https://inventory.upserve.com/http://google.com/Analysed#469803 | Valid | Upserve | Open Redirect | – | 2019-06-07 | $1,200 | 179 |
| How The Hackers Saved ChristmasAnalysed#1069335 | Valid | h1-ctf | Information Disclosure | – | 2021-01-11 | – | 179 |
| Reflected Cross site Scripting (XSS) on www.starbucks.comAnalysed#438240 | Valid | Starbucks | Cross-site Scripting | – | 2019-03-08 | – | 181 |
| Authentication bypass on gist.github.com through SSH CertificatesAnalysed#1901040 | Valid | GitHub | Access Control | – | 2023-04-20 | $10,000 | 182 |
| Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comAnalysed#219205 | Valid | Uber | Authentication | – | 2017-07-13 | – | 183 |
| Take over of accounts created using Google or FacebookAnalysed#442901 | Valid | Khan Academy | Cross-Site Request Forgery | – | 2019-05-17 | – | 184 |
| [PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443 | Valid | PayPal | Open Redirect | – | 2019-02-07 | – | 188 |
| Unauthorized access to metadata of undisclosed reports that were retestedAnalysed#871749 | Valid | HackerOne | Information Disclosure | – | 2020-06-05 | – | 189 |
| H1514 [*.(my)shopify.com] - Viewing Password Protected ContentAnalysed#421859 | Valid | Shopify | Authentication | – | 2019-05-22 | $3,000 | 192 |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosAnalysed#1034257 | Valid | HackerOne | Misconfiguration and Insecure Design | – | 2021-03-25 | – | 194 |
| Helpdesk Takeover at dmc.datastax.comAnalysed#759454 | Valid | DataStax | Input Validation and Logic | – | 2020-01-15 | – | 195 |
| 2020-10-09 Credential Stuffing AttackAnalysed#1007689 | Valid | HackerOne | No weakness recorded | – | 2020-10-13 | – | 196 |
| Reflected XSS on Pangle EndpointAnalysed#2352968 | Valid | TikTok | Cross-site Scripting | – | 2024-04-05 | $5,000 | 196 |
| SAML Signature verification bypass allows logging into any user (with specific conditions)Analysed#2579939 | Valid | GitHub | Access Control | Critical | 2024-10-10 | – | 196 |
| Remote vulnerabilities in sppAnalysed#2177925 | Valid | PlayStation | Memory Corruption | – | 2024-04-25 | $12,500 | 197 |
| Blind SQL injection on id.indrive.comAnalysed#2051931 | Valid | inDrive | SQL Injection | – | 2023-11-24 | $4,134 | 199 |
| www.drivegrab.com SQL injectionAnalysed#273946 | Valid | Grab | SQL Injection | – | 2017-11-17 | $4,500 | 205 |
| DOM Based XSS in www.hackerone.com via PostMessageAnalysed#398054 | Valid | HackerOne | Cross-site Scripting | – | 2019-02-21 | $500 | 208 |
| Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issuesAnalysed#329689 | Valid | Mapbox | Command and Code Injection | – | 2020-07-28 | – | 209 |
| RCE on CS:GO client using unsanitized entity ID in EntityMsg messageAnalysed#584603 | Valid | Valve | Memory Corruption | – | 2021-05-27 | $9,000 | 209 |
| Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Analysed#530441 | Valid | Uber | Access Control | – | 2021-03-06 | $4,500 | 210 |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :*Analysed#549355 | Valid | Starbucks | SQL Injection | – | 2019-06-19 | – | 210 |
| Group search leaks private MRs, code, commitsAnalysed#692252 | Valid | GitLab | Access Control | – | 2019-12-14 | – | 212 |
| Account Takeover in Periscope TVAnalysed#317476 | Valid | X / xAI | Cross-site Scripting | – | 2018-09-06 | – | 213 |
| Discoverability by phone number/email restriction bypassAnalysed#1439026 | Valid | X / xAI | Access Control | – | 2022-02-11 | $5,040 | 217 |
| Google Docs link in JS files allows editing & reading survey informationAnalysed#2180521 | Valid | HackerOne | Information Disclosure | – | 2023-11-04 | – | 217 |
| XXE on https://duckduckgo.comAnalysed#483774 | Valid | DuckDuckGo | Injection and Smuggling | – | 2019-01-31 | – | 218 |
| OOB reads in network message handlers leads to RCEAnalysed#807772 | Valid | Valve | Memory Corruption | – | 2021-05-04 | $7,500 | 219 |
| 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.comAnalysed#3081691 | Valid | hostinger | Access Control | High | 2025-06-06 | – | 219 |
| Ability To Delete User(s) Account Without User InteractionAnalysed#928255 | Valid | GitLab | Misconfiguration and Insecure Design | – | 2021-03-17 | – | 221 |
| Github Account hijack through broken link in developer.twitter.comAnalysed#1031321 | Valid | X / xAI | Input Validation and Logic | – | 2021-02-04 | – | 222 |
| Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateAnalysed#1082847 | Valid | Superhuman (formerly Grammarly) | Input Validation and Logic | – | 2021-03-01 | – | 223 |
| Periscope android app deeplink leads to CSRF in follow actionAnalysed#583987 | Valid | X / xAI | Cross-Site Request Forgery | – | 2020-02-21 | $1,540 | 224 |
| Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationAnalysed#2937622 | Valid | HackerOne | Information Disclosure | Medium | 2025-05-31 | – | 226 |
| Internal Access to Hackerone confluence DocsAnalysed#3113398 | Valid | HackerOne | Misconfiguration and Insecure Design | High | 2025-08-15 | $12,500 | 227 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.