Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Full Page Caching Stored XSS Vulnerability#148300	Informative	Cross-site Scripting	–	2017-04-11	–	1
Content Spoofing possible in concrete5.org#168078	Valid	Misconfiguration and Insecure Design	–	2017-07-23	–	2
Stored XSS in RSS Feeds Title (Concrete5 v8.1.0)#221380	Valid	Cross-site Scripting	–	2017-05-17	–	4
Stored XSS in Express Objects - Concrete5 v8.1.0#221325	Valid	No weakness recorded	–	2017-05-17	–	7
Stored XSS in Name field in User Groups/Group Details form#247521	Valid	Cross-site Scripting	Low	2017-08-17	–	7
Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]#251358	Valid	Cross-site Scripting	Low	2017-11-02	–	7
Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payload#247517	Valid	Cross-site Scripting	High	2017-08-17	–	8
Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)#230029	Valid	Cross-site Scripting	Medium	2017-07-27	–	9
Stored XSS vulnerability in RSS Feeds Description field#248133	Valid	Cross-site Scripting	Low	2017-08-18	–	9
Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ]#230278	Valid	Cross-site Scripting	Medium	2017-07-14	–	12
Password Reset link hijacking via Host Header PoisoningAnalysed#226659	Valid	Access Control	None	2017-06-06	–	73

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.