Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| stored xss in comments : driver examAnalysed#274443 | Valid | Grab | Cross-site Scripting | Medium | 2017-11-30 | $250 | 21 |
| Reflected XSS в m.vk.comAnalysed#311913 | Valid | VK.com | No weakness recorded | High | 2021-11-05 | $500 | 21 |
| Просмотр любых записей на стенеAnalysed#341675 | Valid | VK.com | Information Disclosure | High | 2018-06-18 | $700 | 21 |
| SSRF on jira.mariadb.orgAnalysed#397402 | Valid | MariaDB | Server-Side Request Forgery | Medium | 2018-10-13 | – | 21 |
| CTF Writeup flag{cha1n1ng_bugs_f0r_fun_4nd_pr0f1t?_or_rep0rt_an_LF1}Analysed#415275 | Valid | h1-5411-CTF | Deserialization and Object Injection | Critical | 2018-11-21 | – | 21 |
| Reflected xss в m.vk.com/chatjoinAnalysed#1370240 | Valid | VK.com | Cross-site Scripting | Medium | 2021-11-05 | $500 | 21 |
| Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"Analysed#1525578 | Valid | Palantir Public | Access Control | Low | 2022-05-05 | – | 21 |
| Full Passcode bypass on Nextcloud App iOSAnalysed#1847368 | Valid | Nextcloud | Access Control | Low | 2023-04-10 | – | 21 |
| Open redirect in user_saml via RelayState parameterAnalysed#2263044 | Valid | Nextcloud | Open Redirect | Low | 2024-01-18 | – | 21 |
| XXE in upload file featureAnalysed#105787 | Valid | Informatica | Denial of Service | High | 2017-05-10 | – | 22 |
| Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714)Analysed#143966 | Valid | Internet Bug Bounty | No weakness recorded | – | 2016-05-03 | – | 22 |
| Смотрим фотографии из частных/закрытых групп.Analysed#321594 | Valid | VK.com | Information Disclosure | High | 2018-04-26 | $500 | 22 |
| Remote Code Execution (RCE) in a Sony Pictures WebSystemAnalysed#330028 | Valid | Sony | Deserialization and Object Injection | Critical | 2019-01-23 | – | 22 |
| program_analytics_benchmarks query shows information not visible in publicAnalysed#826176 | Valid | HackerOne | Information Disclosure | Low | 2020-03-27 | – | 22 |
| Rate limiting on report videoAnalysed#948146 | Valid | TikTok | Authentication | Low | 2021-02-02 | – | 22 |
| Card requirement bypass for business trialAnalysed#1670304 | Valid | Krisp | Access Control | Low | 2022-10-21 | – | 22 |
| ActionView sanitize helper bypass with noscriptAnalysed#2931691 | Valid | Internet Bug Bounty | Cross-site Scripting | Medium | 2025-02-06 | – | 22 |
| #2931639 ActionView sanitize helper bypass with math-related tagsAnalysed#2931710 | Valid | Internet Bug Bounty | Cross-site Scripting | Medium | 2025-02-06 | – | 22 |
| Calendar attachments of local files are offered to downloadedAnalysed#3112033 | Valid | Nextcloud | Input Validation and Logic | Medium | 2025-12-05 | – | 22 |
| Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.Analysed#216746 | Valid | Phabricator | Cryptography | Medium | 2017-04-05 | $750 | 23 |
| XSS в личных сообщенияхAnalysed#281851 | Valid | VK.com | Cross-site Scripting | High | 2017-11-27 | – | 23 |
| CSRF на установку своей почты к аккаунту.Analysed#301586 | Valid | VK.com | Cross-Site Request Forgery | Critical | 2021-05-23 | – | 23 |
| SMTP Failure Leads to Chain of Internal System FailureAnalysed#642488 | Valid | Kartpay | Information Disclosure | High | 2019-08-28 | – | 23 |
| Privilege Escalation vulnerability in steam's Remote Play feature leads to arbitrary kernel-mode driver installationAnalysed#852091 | Valid | Valve | Access Control | Medium | 2021-09-21 | – | 23 |
| [H1-2006 2020] H1-2006 CTF WriteupAnalysed#887611 | Valid | h1-ctf | Information Disclosure | Critical | 2020-06-18 | – | 23 |
| weak password poilicy in signup password leak to account takeoverAnalysed#985367 | Valid | Stripo Inc | Misconfiguration and Insecure Design | None | 2020-10-16 | – | 23 |
| User In The Same Center Can Create CSRF To Change The Information About BusinessAnalysed#1006306 | Valid | TikTok | Cross-Site Request Forgery | Low | 2020-12-18 | $147 | 23 |
| Blind SSRF in ads.tiktok.comAnalysed#1006599 | Valid | TikTok | Server-Side Request Forgery | Low | 2020-12-17 | – | 23 |
| CSRF on TikTok Ads PortalAnalysed#1087436 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2021-05-26 | $1,000 | 23 |
| ████ api key exposed in github.com/███/███Analysed#1454965 | Valid | 8x8 | Cryptography | High | 2022-02-22 | – | 23 |
| ReDoS due to device-detector parsing user agentsAnalysed#1772063 | Valid | GitLab | Denial of Service | Medium | 2024-10-08 | – | 23 |
| User scoped external storage can be used to gather credentials of other usersAnalysed#1978882 | Valid | Nextcloud | Input Validation and Logic | High | 2023-06-27 | – | 23 |
| The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.Analysed#2546437 | Valid | Rocket.Chat | Cryptography | High | 2024-10-01 | – | 23 |
| Logging a user into attacker's account using password reset linkAnalysed#53531 | Valid | Mapbox | Misconfiguration and Insecure Design | – | 2017-10-20 | $600 | 24 |
| Possible to View Driver Waybill via Driver UUIDAnalysed#127087 | Valid | Uber | Information Disclosure | – | 2016-06-14 | – | 24 |
| Ability to enumerate private programs using SAMLAnalysed#167828 | Valid | HackerOne | Information Disclosure | – | 2016-09-14 | – | 24 |
| Possible subdomain takeover at openapi.starbucks.comAnalysed#241503 | Valid | Starbucks | No weakness recorded | High | 2017-08-15 | – | 24 |
| Уязвимый класс WebViewAnalysed#452835 | Valid | VK.com | No weakness recorded | Medium | 2018-12-31 | $200 | 24 |
| SSRF & unrestricted file upload on https://my.stripo.email/Analysed#771382 | Valid | Stripo Inc | Server-Side Request Forgery | Critical | 2020-02-19 | – | 24 |
| Link-shortener bypass (regression on fix for #1032610)Analysed#1421345 | Valid | X / xAI | Other weaknesses | Medium | 2022-12-12 | $560 | 24 |
| ActionView sanitize helper bypass leading to XSS using SVG tag.Analysed#1694173 | Valid | Ruby on Rails | Cross-site Scripting | Medium | 2023-07-10 | – | 24 |
| Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4Analysed#2290680 | Valid | Nextcloud | Access Control | Medium | 2024-07-14 | $500 | 24 |
| CVE-2021-39226 Discovered on endpoint https://██████/api/snapshotsAnalysed#2408480 | Valid | U.S. Dept Of Defense | Access Control | High | 2024-06-18 | – | 24 |
| Nextcloud Tables app - inserting rows to an arbitrary table possibleAnalysed#2671404 | Valid | Nextcloud | No weakness recorded | Medium | 2024-11-17 | – | 24 |
| Use any User to Follow you (Increase Followers) [IDOR]Analysed#245969 | Valid | Eternal | Insecure Direct Object Reference | Low | 2017-11-28 | $50 | 25 |
| Privilege Escalation to Admin-level AccountAnalysed#261285 | Valid | Legal Robot | Access Control | – | 2017-09-26 | – | 25 |
| Unicorn worker pool exhaustion by continuously updating payout preferencesAnalysed#317543 | Valid | HackerOne | Denial of Service | Medium | 2018-03-30 | – | 25 |
| Reflected XSS в /al_audio.phpAnalysed#334691 | Valid | VK.com | Cross-site Scripting | High | 2018-05-22 | $700 | 25 |
| XSS Reflected on my_reportAnalysed#491023 | Valid | Semrush | Cross-site Scripting | Low | 2019-06-21 | – | 25 |
| Просмотр закрытых фотографийAnalysed#584582 | Valid | VK.com | Information Disclosure | High | 2021-12-15 | $500 | 25 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.