Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=...Analysed#258876 | Valid | Quora | Cross-site Scripting | Low | 2018-01-11 | – | 21 |
| xss filter bypass [polldaddy]Analysed#264832 | Valid | Automattic | Cross-site Scripting | – | 2017-10-01 | – | 21 |
| [www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from ZomatoAnalysed#264919 | Valid | Eternal | Insecure Direct Object Reference | – | 2017-11-28 | – | 21 |
| No Password Verification on Changing Email Address Cause Account takeoverAnalysed#292673 | Valid | Coursera | Misconfiguration and Insecure Design | Medium | 2018-05-19 | – | 21 |
| Stored XSS in learnboost.com via the lesson[goals] parameter.Analysed#300270 | Valid | Automattic | Cross-site Scripting | – | 2018-04-22 | – | 21 |
| Validation bypass for queries generated for PostgreSQLAnalysed#394253 | Valid | Ruby on Rails | No weakness recorded | – | 2018-11-19 | $1,500 | 21 |
| ███████ Site Exposes █████████ formsAnalysed#395246 | Valid | U.S. Dept Of Defense | Insecure Direct Object Reference | Critical | 2019-04-05 | – | 21 |
| Missing Rate Limitation at /apps/upload_app/Analysed#416906 | Valid | Chaturbate | Input Validation and Logic | Low | 2018-10-07 | – | 21 |
| H1514 Stored XSS in Return Magic App portal contentAnalysed#420459 | Valid | Shopify | Cross-site Scripting | Medium | 2019-11-08 | – | 21 |
| H1514 Stored XSS on Wholesale sales channel allows cross-organization data leakageAnalysed#423454 | Valid | Shopify | Cross-site Scripting | Medium | 2019-11-01 | – | 21 |
| Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the reportAnalysed#442843 | Valid | HackerOne | Access Control | Low | 2018-12-04 | $500 | 21 |
| Malformed BSP in GoldSrc Engine may cause shellcode injectionAnalysed#458929 | Valid | Valve | Memory Corruption | High | 2020-03-25 | – | 21 |
| [takeapeek] XSS via HTML tag injection in directory lisiting pageAnalysed#490728 | Valid | Node.js third-party modules | Cross-site Scripting | Medium | 2019-07-01 | – | 21 |
| No rate limit on app.crowdsignal.com (Finish quiz)Analysed#568832 | Valid | Automattic | Input Validation and Logic | Low | 2019-07-27 | – | 21 |
| Stored XSS in https://app.mopub.comAnalysed#642281 | Valid | X / xAI | Cross-site Scripting | Medium | 2019-12-17 | – | 21 |
| Markdown parsing issue enables insertion of malicious tagsAnalysed#758002 | Valid | Phabricator | Cross-site Scripting | – | 2019-12-13 | – | 21 |
| Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.Analysed#776017 | Valid | Kubernetes | Server-Side Request Forgery | High | 2020-10-30 | $5,000 | 21 |
| Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpointAnalysed#810320 | Valid | Helium | Access Control | Medium | 2020-06-29 | – | 21 |
| IDOR on update user preferencesAnalysed#854290 | Valid | Palo Alto Software | Insecure Direct Object Reference | Critical | 2020-05-13 | – | 21 |
| CSRF - Close AccountAnalysed#856518 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2020-06-11 | – | 21 |
| CVE-2020-8169: Partial password leak over DNS on HTTP redirectAnalysed#874778 | Valid | curl | Information Disclosure | Medium | 2020-12-05 | – | 21 |
| Password reset link not expired at Stocky AppAnalysed#898841 | Valid | Shopify | Access Control | – | 2020-08-18 | – | 21 |
| XSS / SELF XSSAnalysed#906201 | Valid | Shopify | Cross-site Scripting | Low | 2020-09-14 | – | 21 |
| Account Takeover on unverified emails in File Sync & ShareAnalysed#906790 | Valid | Acronis | Misconfiguration and Insecure Design | Medium | 2021-06-16 | – | 21 |
| Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)Analysed#925527 | Valid | Bitwarden | Server-Side Request Forgery | Low | 2020-09-11 | – | 21 |
| Ability to publish a paid theme without purchasing it.Analysed#927567 | Valid | Shopify | Access Control | Low | 2020-08-27 | $2,000 | 21 |
| Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameterAnalysed#927661 | Valid | Eternal | Misconfiguration and Insecure Design | Low | 2020-08-08 | – | 21 |
| Use of unreleased features in programming education service (https://entry.line.me)Analysed#975428 | Valid | LY Corporation | Input Validation and Logic | Medium | 2022-04-18 | – | 21 |
| XSS through image upload of contacts using svg file with png extensionAnalysed#998422 | Valid | Nextcloud | Cross-site Scripting | Low | 2020-12-26 | – | 21 |
| Local Privilege Escalation via Backup deleteAnalysed#1003007 | Valid | Acronis | Access Control | Medium | 2024-08-27 | $250 | 21 |
| [dubmash] Lack of authorization checks - Update Sound TitlesAnalysed#1102365 | Valid | Access Control | High | 2021-10-21 | – | 21 | |
| staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings PermissionAnalysed#1102652 | Valid | Shopify | Access Control | Low | 2022-02-09 | – | 21 |
| staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings PermissionAnalysed#1102660 | Valid | Shopify | Access Control | Low | 2022-02-09 | – | 21 |
| Reporters can upload design to issues using the "Move to" featureAnalysed#1112297 | Valid | GitLab | Access Control | Medium | 2021-10-18 | $600 | 21 |
| Notification implicit PendingIntent in com.nextcloud.client allows to access contactsAnalysed#1161401 | Valid | Nextcloud | Information Disclosure | Low | 2022-05-27 | $250 | 21 |
| Session Hijacking leads to full control of account by attackerAnalysed#1201396 | Valid | UPchieve | No weakness recorded | None | 2021-06-24 | – | 21 |
| Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine AccessAnalysed#1218680 | Valid | Elastic | Access Control | High | 2021-08-03 | – | 21 |
| com.basecamp.bc3 Webview Javascript Injection and JS bridge takeoverAnalysed#1343300 | Valid | Basecamp | Cross-site Scripting | High | 2022-09-23 | – | 21 |
| Normal User is able to EXPORT Feature Usage StatisticsAnalysed#1470076 | Valid | Lark Technologies | Access Control | Medium | 2022-03-04 | – | 21 |
| Renderers can obtain access to random bluetooth device without permissionAnalysed#1519099 | Valid | Internet Bug Bounty | Access Control | Low | 2022-04-23 | $480 | 21 |
| Disconnecting an external login provider does not revoke sessionAnalysed#1547684 | Valid | Shopify | Authentication | Medium | 2022-12-01 | $1,600 | 21 |
| Create product discounts of any shopAnalysed#1571578 | Valid | TikTok | Insecure Direct Object Reference | Medium | 2022-09-21 | – | 21 |
| Campaign Account Balance and History Disclosed in API ResponseAnalysed#1587374 | Valid | Insecure Direct Object Reference | Medium | 2022-11-30 | – | 21 | |
| Improper Access Control in Ali Express ImporterAnalysed#1609955 | Valid | Judge.me | Access Control | Medium | 2023-02-01 | – | 21 |
| Rocket.Chat Server RCEAnalysed#1631258 | Valid | Rocket.Chat | Command and Code Injection | Critical | 2023-03-04 | – | 21 |
| Completely remove VPN profile from locked WARP iOS cient.Analysed#1633231 | Valid | Cloudflare Public Bug Bounty | Input Validation and Logic | High | 2022-11-07 | $1,000 | 21 |
| Possibility to delete files attached to deck cards of other usersAnalysed#1755555 | Valid | Nextcloud | Insecure Direct Object Reference | Low | 2023-01-09 | – | 21 |
| Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING queryAnalysed#1824342 | Valid | HackerOne | Information Disclosure | Medium | 2023-02-22 | – | 21 |
| HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome ExtensionAnalysed#1874260 | Valid | HackerOne | Cross-site Scripting | Low | 2023-02-14 | – | 21 |
| CVE-2023-27535: FTP too eager connection reuseAnalysed#1912778 | Valid | Internet Bug Bounty | Input Validation and Logic | Medium | 2023-03-20 | $2,400 | 21 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.