Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
open redirect to a remote website which can phish users#1397804	Informative	Open Redirect	Medium	2022-11-25	–	4
Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text"#616770	Valid	Cross-site Scripting	Medium	2021-10-04	–	5
Phar Deserialization Vulnerability via Logging Settings#1063039	Valid	Deserialization and Object Injection	Medium	2021-09-24	–	5
Unauthenticated HTML Injection Stored - ContactUs form#768327	Valid	No weakness recorded	Medium	2020-09-25	–	6
Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)#230029	Valid	Cross-site Scripting	Medium	2017-07-27	–	9
Stored unauth XSS in calendar event via CSRF#1102018	Valid	Cross-site Scripting	Medium	2021-10-15	–	10
A bypass of adding remote files in concrete5 FIlemanager leads to remote code execution#1350444	Valid	No weakness recorded	Medium	2021-11-11	–	10
Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ]#230278	Valid	Cross-site Scripting	Medium	2017-07-14	–	12
Unauthenticated reflected XSS in preview_as_user function#643442	Valid	Cross-site Scripting	Medium	2019-12-06	–	12
Time-base SQL Injection in Search UsersAnalysed#876800	Valid	SQL Injection	Medium	2020-08-05	–	60
Remote Code Execution (Reverse Shell) - File ManagerAnalysed#768322	Valid	Command and Code Injection	Medium	2020-07-21	–	114

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.