Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| IDOR leaking PII data via VendorId parameterAnalysed#1690044 | Valid | Insecure Direct Object Reference | Medium | 2022-10-14 | – | 23 |
| IDOR Exposes PII of Tens of Thousands of Users and SupervisorsAnalysed#2967032 | Valid | Insecure Direct Object Reference | High | 2026-01-12 | – | 23 |
| CSRF Account Deletion on ███ WebsiteAnalysed#840285 | Valid | Cross-Site Request Forgery | Medium | 2020-07-09 | – | 24 |
| Full account takeover on https://████████.milAnalysed#1058015 | Valid | Access Control | Critical | 2021-01-25 | – | 24 |
| Leaks of username and password leads to CVE-2018-18862 exploitationAnalysed#1990338 | Valid | Access Control | High | 2023-06-02 | – | 24 |
| ██████ SSN/EDPIAnalysed#1541817 | Valid | Information Disclosure | High | 2024-10-25 | – | 26 |
| Email Takeover leads to permanent account deletionAnalysed#2587953 | Valid | Insecure Direct Object Reference | High | 2024-07-19 | – | 26 |
| IDOR while uploading ████ attachments at [█████████]Analysed#1196976 | Valid | Insecure Direct Object Reference | High | 2021-06-30 | – | 27 |
| [hta3] Remote Code Execution on https://███ via improper access control to SCORM Zip upload/importAnalysed#1122791 | Valid | Command and Code Injection | Critical | 2022-09-15 | – | 28 |
| Trace.axd page leaks sensitive informationAnalysed#519418 | Valid | Information Disclosure | Critical | 2019-08-19 | – | 29 |
| IDOR to Account Takeover on https://████/index.htmlAnalysed#969223 | Valid | Insecure Direct Object Reference | Critical | 2020-09-29 | – | 29 |
| █████████ IDOR leads to disclosure of PHI/PIIAnalysed#1085782 | Valid | Insecure Direct Object Reference | Critical | 2021-02-18 | – | 30 |
| SQL Injection at https://████████.asp (█████████) [selMajcom] [HtUS]Analysed#1628408 | Valid | SQL Injection | Critical | 2023-01-06 | – | 30 |
| CSRF to XSSAnalysed#2736979 | Valid | Cross-Site Request Forgery | Medium | 2024-12-18 | – | 31 |
| Blind Stored XSS Payload fired at the backend on https://█████████/Analysed#1051369 | Valid | Cross-site Scripting | Critical | 2021-03-24 | – | 33 |
| CSRF Attack leads to delete album atAnalysed#2652190 | Valid | Cross-Site Request Forgery | Medium | 2024-12-18 | – | 33 |
| [██████] Cross-origin resource sharing misconfiguration (CORS)Analysed#470298 | Valid | Access Control | High | 2019-01-28 | – | 34 |
| Course Registration Form Allowing an attacker to dump all the candidate name who had enrolled for the courseAnalysed#1100383 | Valid | Information Disclosure | High | 2024-08-16 | – | 36 |
| [HTA2] XXE on https://███ via SpellCheck Endpoint.Analysed#715949 | Valid | Injection and Smuggling | Critical | 2023-05-15 | – | 37 |
| IDOR : Modify other users demographic detailsAnalysed#2586662 | Valid | Insecure Direct Object Reference | Medium | 2024-07-19 | – | 40 |
| █████████ (Android): Vulnerable to Javascript Injection and Open redirectAnalysed#2555949 | Valid | Open Redirect | Medium | 2024-07-26 | – | 41 |
| Account takeover through CSRF in http://███████/██████████/default.aspAnalysed#670924 | Valid | Cross-Site Request Forgery | High | 2020-06-11 | – | 42 |
| IDOR leads to view other user Biographical details (Possible PII LEAK)Analysed#2586641 | Valid | Insecure Direct Object Reference | Medium | 2024-07-19 | – | 42 |
| Xss - ███Analysed#2353185 | Valid | Cross-site Scripting | Medium | 2024-03-22 | – | 45 |
| SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]Analysed#1628209 | Valid | Server-Side Request Forgery | Critical | 2022-09-14 | $4,000 | 46 |
| Pull Any Automated Record BriefAnalysed#1541740 | Valid | Information Disclosure | Critical | 2024-10-25 | – | 47 |
| CSRF Attack on changing security questions leads to full Account TakeOverAnalysed#2652603 | Valid | Cross-Site Request Forgery | High | 2024-12-18 | – | 47 |
| SQL Injection in ████Analysed#519631 | Valid | SQL Injection | High | 2019-08-19 | – | 49 |
| IDOR leads to PII LeakAnalysed#2586584 | Valid | Insecure Direct Object Reference | Medium | 2024-07-19 | – | 64 |
| CSRF leads to Account takeoverAnalysed#2712857 | Valid | Cross-Site Request Forgery | High | 2024-12-18 | – | 67 |
| Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)Analysed#1556950 | Valid | Misconfiguration and Insecure Design | Critical | 2025-01-24 | – | 69 |
| CSRF leads to Account takeoverAnalysed#2699029 | Valid | Cross-Site Request Forgery | High | 2024-12-18 | – | 87 |
| ███ leaking PII of tour visitors (names, email addresses, phone numbers) via misconfigured record permissionsAnalysed#2294930 | Valid | Cryptography | Critical | 2024-03-22 | – | 90 |
| [hta3] Remote Code Execution on ████Analysed#1072832 | Valid | Command and Code Injection | Critical | 2023-05-15 | – | 104 |
| Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.milAnalysed#2950536 | Valid | Access Control | Critical | 2025-02-12 | – | 142 |
| Stored Xss Vulnerability on ████████Analysed#380103 | Valid | Cross-site Scripting | High | 2020-05-14 | – | 192 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.