Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS in topics because of whitelisted_generic engine vulnerability#197902	Valid	Cross-site Scripting	High	2017-01-20	–	13
Stored XSS in posts because of absence of oembed variables values escaping#197914	Valid	Cross-site Scripting	High	2017-01-20	–	13
XSS Vulnerability on Image link parser#191909	Valid	Cross-site Scripting	High	2017-01-10	$256	15
XSS vulnerability on Audio and Video parsers#192223	Valid	Cross-site Scripting	High	2017-01-10	$256	15
XSS in topics because of bandcamp preview engine vulnerability#197443	Valid	Cross-site Scripting	High	2017-01-20	–	15
Gaining access to private topics using quoting featureAnalysed#312647	Valid	Access Control	High	2018-03-17	$256	19
Stored XSS in "post last edited" optionAnalysed#333507	Valid	Cross-site Scripting	High	2018-07-09	$256	19
DOM Based XSS in Discourse SearchAnalysed#191890	Valid	Cross-site Scripting	High	2017-01-10	–	29
Admin Command Injection via username in user_archive ExportCsvFileAnalysed#214022	Valid	Command and Code Injection	High	2017-05-13	$512	45
Web Cache Deception Attack (XSS)Analysed#394016	Valid	Cross-site Scripting	High	2018-11-18	$256	51
Arbitrary Local-File Read from Admin - Restore From Backup due to SymlinksAnalysed#213558	Valid	Information Disclosure	High	2017-05-13	$512	52
Application Level DoS - Large Markdown Payload in Reply Section Leading to Resource ExhaustionAnalysed#3058919	Valid	Denial of Service	High	2025-10-18	–	84
Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo accountAnalysed#423022	Valid	Cross-Site Request Forgery	High	2018-12-06	–	89
Denial of Service (DoS) Vulnerability in Drafts Creation EndpointAnalysed#3400140	Valid	Denial of Service	High	2026-06-30	$1,024	98

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.