Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL Injection on █████Analysed#277380 | Valid | SQL Injection | High | 2022-05-12 | – | 21 |
| Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://███Analysed#678496 | Valid | Command and Code Injection | Critical | 2019-12-02 | – | 21 |
| Reflected XSS in https://www.██████/Analysed#924650 | Valid | Cross-site Scripting | Medium | 2020-09-29 | – | 21 |
| Reflected XSS in ████████████Analysed#1882592 | Valid | Cross-site Scripting | Medium | 2023-04-14 | – | 21 |
| WordPress application vulnerable to DoS attack via wp-cron.phpAnalysed#1888723 | Valid | Denial of Service | Critical | 2023-04-14 | – | 21 |
| Full Access to sonarQube and DockerAnalysed#2312609 | Valid | Information Disclosure | Critical | 2024-03-22 | – | 21 |
| XML External Entity (XXE) InjectionAnalysed#2573567 | Valid | Injection and Smuggling | High | 2024-07-19 | – | 21 |
| Reflected XSS Vulnerability in SSL VPN Endpoint — CVE-2025-0133Analysed#3238607 | Valid | Cross-site Scripting | Medium | 2026-01-12 | – | 21 |
| Unauth IDOR to mass account takeover without user interaction on the ███████ (https://███████.edu/)Analysed#685338 | Valid | Insecure Direct Object Reference | High | 2024-07-19 | – | 22 |
| [Partial] SSN & [PII] exposed through iPERMs Presentation Slide.Analysed#719631 | Valid | Information Disclosure | Critical | 2019-12-02 | – | 22 |
| Subdomain takeover due to an unclaimed Amazon S3 bucket on ███Analysed#918946 | Valid | Cross-site Scripting | Critical | 2020-09-03 | – | 22 |
| Default Admin Username and Password on ███Analysed#2262365 | Valid | Access Control | Critical | 2023-12-21 | – | 22 |
| Resource Injection - [████████]Analysed#2297561 | Valid | Injection and Smuggling | Medium | 2024-03-22 | – | 22 |
| CSRF Attack leads to delete album at ████████Analysed#2697588 | Valid | Cross-Site Request Forgery | Medium | 2024-12-18 | – | 22 |
| SSRF on █████████ Allowing internal server data accessAnalysed#326040 | Valid | Information Disclosure | Critical | 2019-10-08 | – | 23 |
| SQL injection on the https://████/Analysed#488795 | Valid | SQL Injection | High | 2019-10-04 | – | 23 |
| Reflected XSS in https://www.█████/Analysed#950700 | Valid | Cross-site Scripting | Medium | 2020-09-29 | – | 23 |
| Password Reset link hijacking via Host Header Poisoning leads to account takeoverAnalysed#1108874 | Valid | Access Control | Critical | 2021-04-02 | – | 23 |
| Sensitive information disclosure [HtUS]Analysed#1632104 | Valid | Information Disclosure | High | 2023-02-24 | – | 23 |
| Apache solr RCE via velocity templateAnalysed#822002 | Valid | Command and Code Injection | Critical | 2021-01-12 | – | 24 |
| Information Disclosure FrontPage Configuration InformationAnalysed#2180018 | Valid | Access Control | Medium | 2023-10-20 | – | 24 |
| Reflected XSS via Moodle on ███ [CVE-2022-35653]Analysed#2444032 | Valid | Cross-site Scripting | Medium | 2024-05-03 | – | 24 |
| Access to all █████████ files, including CAC authentication bypassAnalysed#429000 | Valid | Insecure Direct Object Reference | Critical | 2019-04-08 | – | 25 |
| Request smuggling on ████████Analysed#526880 | Valid | Injection and Smuggling | High | 2019-10-08 | – | 25 |
| Examples directory is PUBLIC on https://████████mil, leading to multiple vulnsAnalysed#674741 | Valid | Access Control | Critical | 2019-10-10 | – | 25 |
| Local File Inclusion in download.phpAnalysed#1639364 | Valid | Input Validation and Logic | Medium | 2024-07-19 | – | 25 |
| Video player on ███ allows arbitrary remote videos to be playedAnalysed#195635 | Valid | Misconfiguration and Insecure Design | Medium | 2019-12-02 | – | 26 |
| ████ - Complete account takeoverAnalysed#566811 | Valid | Authentication | Critical | 2020-05-11 | – | 26 |
| Command Injection (via CVE-2019-11510 and CVE-2019-11539)Analysed#680480 | Valid | Command and Code Injection | Critical | 2020-05-07 | – | 26 |
| Reflected XSSAnalysed#1390131 | Valid | Cross-site Scripting | Medium | 2023-01-06 | – | 26 |
| Client side authentication leads to Auth BypassAnalysed#1877989 | Valid | Authentication | Medium | 2023-03-24 | – | 26 |
| XSS ReflectedAnalysed#2741110 | Valid | Cross-site Scripting | Medium | 2024-12-18 | – | 26 |
| [ CVE-2018-1000129 ] RXSS At `https://███████` via the URIAnalysed#2778412 | Valid | Cross-site Scripting | Medium | 2024-12-18 | – | 26 |
| Remote Code Execution via Insecure Deserialization in Telerik UI (CVE-2019-18935)Analysed#1174185 | Valid | Deserialization and Object Injection | Critical | 2021-06-03 | – | 27 |
| Docker Registry without authentication leads to docker images downloadAnalysed#1989884 | Valid | Access Control | Medium | 2023-06-23 | – | 27 |
| [HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amfAnalysed#728614 | Valid | Deserialization and Object Injection | Critical | 2024-06-18 | – | 28 |
| Reflected XssAnalysed#758854 | Valid | Cross-site Scripting | Medium | 2020-09-21 | – | 28 |
| [███████] Remote Code Execution at ██████ [CVE-2021-44529] [HtUS]Analysed#1624172 | Valid | Command and Code Injection | Critical | 2023-01-06 | $1,000 | 28 |
| Unauthenticated Blind SSRF at https://█████ via xmlrpc.php fileAnalysed#1890719 | Valid | Server-Side Request Forgery | High | 2023-04-14 | – | 28 |
| Reflected xss on https://█████████Analysed#1988560 | Valid | Cross-site Scripting | Medium | 2023-06-02 | – | 28 |
| Endpoint Redirects to Admin Page and Provides Admin roleAnalysed#1991290 | Valid | Access Control | Critical | 2024-07-19 | – | 28 |
| Unauthorized Access Exposing Sensitive DataAnalysed#2858876 | Valid | Authentication | High | 2024-12-18 | – | 28 |
| Unauthenticated Users Can Access Other Users’ Bug Report Attachments via Broken Access ControlAnalysed#3259610 | Valid | Insecure Direct Object Reference | High | 2026-01-12 | – | 28 |
| SQL injectionAnalysed#311922 | Valid | SQL Injection | High | 2018-04-17 | – | 29 |
| DoD internal documents are leaked to the publicAnalysed#1330455 | Valid | Information Disclosure | Medium | 2021-10-15 | – | 29 |
| SQL injection at [https://█████████] [HtUS]Analysed#1627995 | Valid | SQL Injection | Critical | 2022-09-14 | – | 29 |
| SSRF vulnerability on ██████████ leaks internal IP and various sensitive informationAnalysed#310036 | Valid | Server-Side Request Forgery | Medium | 2019-12-02 | – | 30 |
| SOAP WSDL Parser SQL Code ExecutionAnalysed#390359 | Valid | SQL Injection | Critical | 2019-01-16 | – | 30 |
| Authentication bypass and RCE on the https://████ due to exposed Cisco TelePresence SX80 with default credentialsAnalysed#684070 | Valid | Authentication | Critical | 2021-01-12 | – | 30 |
| Default Admin Username and Password on █████ Server at █████████milAnalysed#1195325 | Valid | Access Control | Critical | 2021-06-15 | – | 30 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.