Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Sensitive data disclosure via exposed phpunit file#543775 | Valid | Information Disclosure | High | 2020-06-09 | – | 1 |
| Open Redirect on [blog.wavecell.com]#929633 | Valid | Open Redirect | Low | 2020-10-26 | – | 1 |
| Sensitive information disclosure#504122 | Valid | Information Disclosure | Medium | 2020-02-12 | – | 2 |
| Reflected XSS on http://axa.dxi.eu#722281 | Valid | Cross-site Scripting | Medium | 2020-06-09 | – | 3 |
| SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server#922567 | Valid | SQL Injection | High | 2020-07-29 | – | 3 |
| XSS (Cross site scripting) on https://apimgr.8x8.com#412754 | Valid | Cross-site Scripting | Medium | 2020-06-09 | – | 4 |
| Bypass Email activation on http://axa.dxi.eu#418267 | Valid | Access Control | High | 2020-06-09 | – | 4 |
| Stored XSS agent_status#418271 | Valid | Cross-site Scripting | High | 2020-06-09 | – | 4 |
| Stored XSS on Company Logo#808167 | Valid | Cryptography | Medium | 2020-07-07 | – | 5 |
| DLL Search-Order Hijacking Vulnerability in work-64-exe-v7.16.3-1.exe#1519437 | Valid | Access Control | Low | 2022-09-22 | – | 5 |
| Subdomain Takeover at http://██.get8x8.com/#1697402 | Valid | Supply Chain and Malicious Code | Medium | 2022-10-14 | – | 5 |
| Publicly accessible .svn repository - aastraconf.packet8.net#710368 | Valid | Information Disclosure | Medium | 2020-06-22 | – | 6 |
| [CRITICAL] Sql Injection on http://axa.dxi.eu#722145 | Valid | SQL Injection | Critical | 2020-06-09 | – | 6 |
| PHPinfo page on http://█████.callstats.io#907701 | Valid | Information Disclosure | Low | 2020-07-02 | – | 6 |
| 8x8pilot.com: Reflected XSS in Apache Tomcat /jsp-examples example directory#1400357 | Valid | Cross-site Scripting | Medium | 2022-05-19 | – | 6 |
| xmlrpc.php file enabled#773888 | Valid | Server-Side Request Forgery | Medium | 2020-06-09 | – | 7 |
| IDOR: Adding Contacts to Other User Groups#879960 | Valid | Insecure Direct Object Reference | Low | 2020-07-27 | – | 7 |
| Default Creds Spring Boot Admin#954818 | Valid | Information Disclosure | High | 2020-08-14 | – | 7 |
| Hardcoded AWS credentials in ███████.msi#1368690 | Valid | Authentication | Critical | 2022-04-29 | – | 7 |
| Post based XSS (Cross site scripting) on https://apimgr.8x8.com#418248 | Valid | Cross-site Scripting | Medium | 2020-06-22 | – | 8 |
| [CRITICAL] Remote code execution on http://axa.dxi.eu#418308 | Valid | Command and Code Injection | Critical | 2020-06-09 | – | 8 |
| Open Redirect on https://██.8x8.com/login?nextPage=%2F#1467046 | Valid | Open Redirect | Low | 2022-03-10 | – | 8 |
| Xss (cross site scripting) on http://axa.dxi.eu/#722301 | Valid | Cross-site Scripting | Medium | 2020-06-09 | – | 9 |
| Disclosure of Users Information On Wordpress Api [https://jitsi.org/]#772778 | Valid | Access Control | Low | 2020-01-23 | – | 9 |
| Send Phishing/Spam email from support@sameroom.io to any email address.#840688 | Valid | Input Validation and Logic | High | 2020-08-05 | – | 9 |
| Outdated Coturn is vulnerable to known vulnerabilities (High)#843263 | Valid | Authentication | High | 2020-04-13 | – | 9 |
| DOM Based XSS at docs.8x8.com#895917 | Valid | Cross-site Scripting | Medium | 2020-09-22 | – | 9 |
| Dangling DNS Record docs.jitsi.net (unsuccessful GSuite takeover)#1354066 | Valid | Misconfiguration and Insecure Design | Low | 2023-04-03 | – | 9 |
| subdomain takeover (abandoned Zendesk █.easycontactnow.com)#1486670 | Valid | No weakness recorded | Medium | 2022-04-28 | – | 9 |
| Cross-site Scripting (XSS) - Reflected#503988 | Valid | Cross-site Scripting | High | 2020-07-07 | – | 10 |
| Directory listing of https://get8x8.com/#853410 | Valid | No weakness recorded | Low | 2020-06-09 | – | 10 |
| DNS Misconfiguration (Subdomain Takeover) ███████.8x8.com#1101877 | Valid | Access Control | High | 2021-02-12 | – | 10 |
| Exposed PHP dependencies at ██.8x8.com#1132457 | Valid | Information Disclosure | Low | 2021-10-27 | – | 10 |
| DNS Misconfiguration (Subdomain Takeover) █.staging.█.8x8.com#1108125 | Valid | Access Control | High | 2021-02-28 | – | 11 |
| Unprotected Atlantis Server at https://152.70.█.█#1793526 | Valid | Authentication | Medium | 2022-12-06 | – | 11 |
| CRLF injection agentcrm.8x8.com#413115 | Valid | Injection and Smuggling | Medium | 2020-06-26 | – | 12 |
| vidyard api auth_token exposed#878434 | Valid | Information Disclosure | Medium | 2020-12-15 | – | 12 |
| Subdomain takeover of ████.jitsi.net#1197013 | Valid | Access Control | High | 2021-05-14 | – | 12 |
| connect.8x8.com: Too much resource consumption of the server due to incorrect date range control via /api/v1/reports?dateFrom=#1877185 | Valid | Misconfiguration and Insecure Design | Low | 2023-06-26 | – | 12 |
| (Critical) Remote Code Execution Through Old TinyMCE upload bypass#778629 | Valid | Command and Code Injection | High | 2020-02-12 | – | 13 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)#1440161 | Valid | Cross-site Scripting | Low | 2022-01-05 | – | 13 |
| Directory Listing vulnerability on █.packet8.net/php/include/#790846 | Valid | Information Disclosure | Low | 2022-09-28 | – | 14 |
| 2FA Disable With Wrong Password - Response Tampering.#893085 | Valid | Input Validation and Logic | High | 2020-10-21 | – | 14 |
| DNS Misconfiguration (Subdomain Takeover) ███.wavecell.com#1089502 | Valid | Access Control | High | 2021-02-15 | – | 15 |
| Open Redirect ███.8x8.com#1637571 | Valid | Open Redirect | Low | 2022-07-17 | – | 15 |
| speedtest.8x8.com: Enabled Directory Listing#1825472 | Valid | Information Disclosure | Low | 2023-03-28 | – | 15 |
| Reflected xss on 8x8.vc#771110 | Valid | Cross-site Scripting | Medium | 2020-01-15 | – | 16 |
| Hardcoded credentials in Android App#412772 | Valid | Information Disclosure | High | 2020-06-22 | – | 17 |
| Public Apache Tomcat /examples example directory#1622624 | Valid | Information Disclosure | Medium | 2022-07-18 | – | 17 |
| Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution#2095061 | Valid | Command and Code Injection | Medium | 2024-08-26 | – | 17 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.