Arbitrary file read in Rocket.Chat-Desktop Analysed #943737 Valid Rocket.Chat No weakness recorded Medium 2022-02-06 – 14 Authenticated Cross-site Scripting in Template Name Analysed #220903 Valid WordPress Cross-site Scripting Medium 2017-11-18 – 15 Arbitrary File Download as Shopmanager Analysed #402473 Valid Automattic File and Path Handling High 2019-12-19 – 15 EdgeSwitch Command Injection Analysed #508256 Valid Ubiquiti Inc. Command and Code Injection Medium 2019-03-31 – 15 Acronis True Image Local Privilege Escalation via insecure folder permissions Analysed #908162 Valid Acronis Access Control Medium 2021-02-23 $300 15 resetreportedcount & updatetags doesn't verify appid param Analysed #351106 Valid Valve Authentication Medium 2018-07-02 $750 19 Stored XSS on 1.4.0 Analysed #1331281 Valid ImpressCMS Cross-site Scripting Medium 2021-12-18 – 19 Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations` Analysed #1543770 Valid Reddit Input Validation and Logic Low 2022-07-04 $100 19 Stored-XSS in Banner Name field Analysed #3404968 Valid Revive Adserver Cross-site Scripting Low 2025-11-19 – 21 [CS 1.6] Map cycle abuse allows arbitrary file read/write Analysed #590279 Valid Valve Access Control Medium 2021-02-22 $750 22 Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee Analysed #808975 Valid HackerOne Input Validation and Logic Low 2020-05-15 – 22 Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers Analysed #210190 Valid HackerOne Information Disclosure Medium 2017-04-05 $500 24 GetReports works for hubs you don't have access to Analysed #350937 Valid Valve Information Disclosure Medium 2018-05-30 $750 24 Improper sanitisation of input in the settings could cause DoS Analysed #3399218 Valid Revive Adserver Input Validation and Logic Low 2025-11-19 – 24 GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson Analysed #1066203 Valid Stripe Insecure Direct Object Reference High 2022-03-08 – 25 PHP Code Injection through "previewBlock()" method Analysed #1092574 Valid Invision Power Services, Inc. Command and Code Injection High 2021-05-28 – 26 An organization admin can create an attacker-controlled organization owner via the gem transfer flow Analysed #3938927 Valid RubyGems Access Control High 2026-10-15 – 27 OS Command Injection in Nexus Repository Manager 2.x Analysed #654888 Valid Central Security Project Command and Code Injection Critical 2019-08-20 – 28 Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation) Analysed #3413764 Valid Revive Adserver Injection and Smuggling Medium 2025-11-19 – 28 Ability to escape database transaction through SQL injection, leading to arbitrary code execution Analysed #1663299 Valid HackerOne SQL Injection High 2022-08-09 – 29 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole Analysed #1084638 Valid Shopify Access Control Medium 2022-04-21 – 31 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Nextcloud Access Control Low 2023-12-21 $100 31 Stored XSS in merge request creation page through payload in approval rule name Analysed #1342009 Valid GitLab Cross-site Scripting High 2022-03-31 – 32 Maintainer can leak sentry token by changing the configured URL (fix bypass) Analysed #2104591 Valid GitLab Information Disclosure Medium 2024-10-08 – 32 Script Editor preview token still working with uninstalled application, even for unpublished script Analysed #915940 Valid Shopify No weakness recorded – 2020-08-25 – 33 OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475) Analysed #688270 Valid Central Security Project Command and Code Injection Critical 2019-10-29 – 34 Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups Analysed #3674940 Valid Nextcloud Access Control Medium 2026-09-17 – 36 DOM based XSS in the WooCommerce plugin Analysed #507139 Valid Automattic Cross-site Scripting Medium 2019-05-05 – 37 User with privilege to maintain External Programs can update certain churned HackerOne programs Analysed #411930 Valid HackerOne Access Control Low 2018-10-25 $500 41 IE 11 Self-XSS on Jira Integration Preview Base Link Analysed #212721 Valid HackerOne Cross-site Scripting Low 2017-03-29 $750 42 RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention Analysed #2216036 Valid GitHub Misconfiguration and Insecure Design Medium 2024-01-12 – 50 SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30X Analysed #1544133 Valid Kubernetes Server-Side Request Forgery Medium 2022-12-10 $1,000 51 A malicious admin can be able to permanently disable a Owner(Admin) to access his account Analysed #1718574 Valid Linktree Insecure Direct Object Reference Medium 2022-10-25 $600 55 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli Analysed #3073507 Valid Internet Bug Bounty Authentication Low 2025-05-29 – 57 Disclosure of Email title report in quick award paypout email (no content mode) Analysed #689997 Valid HackerOne Information Disclosure Low 2019-10-11 $500 62 Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries Analysed #3378635 Valid lemlist No weakness recorded High 2025-11-07 – 65 Authenticated path traversal to Stored XSS and Denial-of-Service Analysed #2168002 Valid phpBB Cross-site Scripting – 2023-10-29 – 69 CVE-2024-41937: Apache Airflow: Stored XSS Vulnerability on provider link Analysed #2677187 Valid Internet Bug Bounty Cross-site Scripting Low 2024-09-07 $497 70 Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise Server Analysed #2336236 Valid GitHub No weakness recorded High 2024-09-13 – 71 Stored XSS in Discounts section Analysed #618031 Valid Shopify Cross-site Scripting Medium 2019-06-27 $1,000 75 XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution Analysed #3447021 Valid Automattic No weakness recorded – 2026-02-18 – 76 Near to Infinite loop when changing Group's name that has API token as Team Member Analysed #880187 Valid HackerOne No weakness recorded Medium 2020-07-23 $2,500 77 Program admins could add verified domains to an organization Analysed #2323303 Valid HackerOne Access Control Low 2024-03-07 – 83 Bypass invite accept for victim Analysed #1663361 Valid Slack Input Validation and Logic Medium 2023-02-17 – 84 Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId) Analysed #3572848 Valid Nextcloud Access Control Medium 2026-05-21 $150 100 Mass account takeover! Analysed #1634165 Valid Stripe Misconfiguration and Insecure Design High 2022-12-21 – 101 connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invites Analysed #1474536 Valid 8x8 Access Control High 2023-02-15 – 105 Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification Analysed #3560256 Valid GitHub Insecure Direct Object Reference Medium 2026-05-19 – 108 ISteamAssets gives partners control over unrelated community market transactions Analysed #577584 Valid Valve Access Control High 2019-05-23 – 109 Cross-Site Request Forgery Analysed #2041007 Valid ownCloud Cross-Site Request Forgery High 2023-11-05 – 111