Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CVE-2021-39226 Discovered on endpoint https://██████/api/snapshotsAnalysed#2408480 | Valid | Access Control | High | 2024-06-18 | – | 24 |
| SQL Injection in the `move_papers.php` on the https://██████████Analysed#491191 | Valid | SQL Injection | High | 2020-06-25 | – | 26 |
| CSRF to Cross-site Scripting (XSS)Analysed#1118501 | Valid | Cross-Site Request Forgery | Medium | 2021-03-24 | – | 27 |
| Blind Stored XSS on the internal host - █████████████Analysed#923912 | Valid | Cross-site Scripting | High | 2024-08-16 | – | 28 |
| RCE on a Department of Defense websiteAnalysed#184279 | Valid | Command and Code Injection | Critical | 2017-01-11 | – | 29 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#211381 | Valid | Command and Code Injection | Critical | 2017-04-13 | – | 29 |
| Information DisclosureAnalysed#330860 | Valid | Information Disclosure | Critical | 2018-04-17 | – | 30 |
| SQL injection my method -1 OR 3*2*1=6 AND 000159=000159Analysed#1250293 | Valid | Command and Code Injection | Medium | 2021-07-29 | – | 32 |
| SSRF+XSSAnalysed#326043 | Valid | Information Disclosure | Critical | 2018-04-17 | – | 33 |
| RCE via File Upload with a Null Byte Truncated File Extension at https://██████/Analysed#2054184 | Valid | Command and Code Injection | Critical | 2023-12-21 | – | 33 |
| XXE on DoD web serverAnalysed#188743 | Valid | Injection and Smuggling | Critical | 2017-01-09 | – | 38 |
| RCE in ███ [CVE-2021-26084]Analysed#1327769 | Valid | Command and Code Injection | Critical | 2023-12-21 | – | 39 |
| Blind Sql Injection https:/████████Analysed#2020429 | Valid | SQL Injection | Medium | 2023-06-30 | – | 39 |
| [HTAF4-213] [Pre-submission] HTTPOnly session cookie exposure on the /csstest endpointAnalysed#723090 | Valid | Information Disclosure | Medium | 2024-06-18 | – | 43 |
| reflected xss [CVE-2020-3580]Analysed#2479161 | Valid | Cross-site Scripting | Medium | 2024-05-03 | – | 43 |
| IDOR to delete profile images in https:███████Analysed#2213900 | Valid | Insecure Direct Object Reference | Medium | 2023-12-21 | – | 52 |
| Time-based blind SQL injectionAnalysed#2759243 | Valid | SQL Injection | Medium | 2025-01-24 | – | 53 |
| LFI with potential to RCE on ██████ using CVE-2019-3396Analysed#538771 | Valid | File and Path Handling | High | 2019-10-04 | – | 58 |
| SQL InjectionAnalysed#2737595 | Valid | SQL Injection | High | 2024-10-25 | – | 91 |
| Remote Code Execution in ██████Analysed#710864 | Valid | Command and Code Injection | Critical | 2020-05-11 | – | 94 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.