Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Unauthorized Access to TikTok Account [Private Videos] via API EndpointAnalysed#2868084 | Valid | TikTok | Insecure Direct Object Reference | Medium | 2025-01-24 | – | 167 |
| IDOR in the https://market.semrush.com/Analysed#837400 | Valid | Semrush | Access Control | – | 2020-04-30 | – | 173 |
| Stored XSS & SSRF in Lark DocsAnalysed#892049 | Valid | Lark Technologies | Server-Side Request Forgery | – | 2021-02-05 | $3,000 | 178 |
| Markdown parsing issue enables insertion of malicious tags and event handlersAnalysed#299728 | Valid | HackerOne | Cross-site Scripting | – | 2018-01-29 | $5,000 | 184 |
| TikTok 2FA BypassAnalysed#1247108 | Valid | TikTok | Access Control | – | 2023-02-03 | $1,564 | 194 |
| sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryAnalysed#769016 | Valid | Starbucks | Information Disclosure | – | 2020-02-26 | – | 197 |
| Blocked user can see live videoAnalysed#1067967 | Valid | TikTok | Information Disclosure | – | 2021-05-28 | $418 | 198 |
| Stealing Facebook OAuth Code Through Screenshot viewerAnalysed#488269 | Valid | Rockstar Games | Information Disclosure | – | 2019-03-05 | – | 200 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Valid | TikTok | Cross-site Scripting | – | 2022-08-19 | – | 201 |
| Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/Analysed#1685970 | Valid | Stripe | Authentication | – | 2022-10-19 | – | 212 |
| Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546 | Valid | TikTok | Authentication | – | 2022-02-23 | $15,000 | 219 |
| An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashierAnalysed#1966006 | Valid | Unikrn | Insecure Direct Object Reference | – | 2023-07-17 | – | 232 |
| SQL Injection in agent-managerAnalysed#962889 | Valid | Acronis | SQL Injection | – | 2021-08-16 | – | 237 |
| Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgAnalysed#1027822 | Valid | Starbucks | Access Control | – | 2020-12-09 | – | 247 |
| SSRF in graphQL query (pwapi.ex2b.com)Analysed#1864188 | Valid | EXNESS | Server-Side Request Forgery | – | 2023-07-24 | $3,000 | 261 |
| Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointAnalysed#2487889 | Valid | HackerOne | Insecure Direct Object Reference | Critical | 2024-05-23 | – | 266 |
| SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Analysed#549882 | Valid | Vimeo | Server-Side Request Forgery | – | 2019-12-13 | – | 276 |
| HTTP Request Smuggling via HTTP/2Analysed#1211724 | Valid | Basecamp | Injection and Smuggling | – | 2021-08-27 | $7,500 | 300 |
| CSRF on connecting Paypal as Payment ProviderAnalysed#807924 | Valid | Shopify | Cross-Site Request Forgery | – | 2020-04-10 | – | 304 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Valid | TikTok | Command and Code Injection | – | 2021-04-15 | – | 312 |
| Reflected XSSAnalysed#739601 | Valid | Bumble | Cross-site Scripting | – | 2019-11-21 | $1,000 | 317 |
| TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesAnalysed#333419 | Valid | Slack | Server-Side Request Forgery | – | 2020-03-12 | $3,500 | 323 |
| SQL Injection on cookie parameterAnalysed#761304 | Valid | MTN Group | SQL Injection | – | 2020-05-03 | – | 323 |
| [www.zomato.com] SQLi - /php/██████████ - item_idAnalysed#403616 | Valid | Eternal | SQL Injection | – | 2018-09-11 | $4,500 | 326 |
| CRLF Injection in urllibAnalysed#590020 | Valid | Internet Bug Bounty | Injection and Smuggling | – | 2020-05-06 | $1,000 | 341 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | TikTok | Cross-Site Request Forgery | – | 2020-12-15 | – | 366 |
| Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500 | Valid | TikTok | Access Control | – | 2021-03-17 | – | 371 |
| Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgAnalysed#340431 | Valid | Uber | Cryptography | – | 2020-04-30 | $4,000 | 376 |
| SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127 | Valid | Valve | SQL Injection | – | 2018-07-27 | $25,000 | 410 |
| How the Bug stole hackingAnalysed#762510 | Valid | HackerOne | Insecure Direct Object Reference | – | 2019-12-20 | – | 471 |
| XSS in steam react chat clientAnalysed#409850 | Valid | Valve | Cross-site Scripting | – | 2019-01-07 | $7,500 | 499 |
| Request smuggling on admin-official.line.me could lead to account takeoverAnalysed#740037 | Valid | LY Corporation | Injection and Smuggling | – | 2020-05-19 | – | 565 |
| Confidential data of users and limited metadata of programs and reports accessible via GraphQLAnalysed#489146 | Valid | HackerOne | Information Disclosure | – | 2019-02-03 | – | 1,033 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.