Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| XSS in IE11 on portswigger.net via FlashAnalysed#182160 | Valid | Cross-site Scripting | – | 2016-11-30 | – | 33 |
| SMTP interaction theft via MITMAnalysed#953219 | Valid | Cryptography | Medium | 2020-11-04 | – | 78 |
| Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionAnalysed#3625600 | Valid | No weakness recorded | Low | 2026-05-05 | $200 | 92 |
| HTML Injection in DAST Trial Request Form Confirmation Email – PortSwiggerAnalysed#3556892 | Valid | No weakness recorded | Low | 2026-02-26 | $200 | 93 |
| Build fetches jars over HTTPAnalysed#506161 | Valid | Cryptography | Medium | 2019-06-10 | $1,000 | 135 |
| [portswigger.net] Path Traversal al /cms/audioitemsAnalysed#2424815 | Valid | File and Path Handling | High | 2024-04-04 | – | 146 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.