Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS in Question edit from product name#1416672 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 7 |
| Stored XSS in Question edit for product name (bypass #1416672)#1428207 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 11 |
| Self-XSS due to image URL can be eploited via XSSJacking techniques in review email#1397940 | Valid | No weakness recorded | Medium | 2023-02-01 | – | 14 |
| stored XSS on AliExpress Review Importer/Products when delete product#1425882 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 15 |
| XSS in Widget Review Form Preview in settings#1595905 | Valid | Cross-site Scripting | Medium | 2022-09-29 | – | 16 |
| Improper Access Control in Ali Express Importer#1609955 | Valid | Access Control | Medium | 2023-02-01 | – | 21 |
| Stored XSS in Public Profile Reviews#1398285 | Valid | Cross-site Scripting | None | 2023-02-01 | $250 | 25 |
| Race condition on https://judge.me/people#1566017 | Valid | Race Conditions | Low | 2022-08-01 | $250 | 26 |
| Stored XSS in "product type" field executed via product filtersAnalysed#1404770 | Valid | No weakness recorded | Medium | 2022-04-26 | $500 | 30 |
| Log4j RCE on https://judge.me/reviewsAnalysed#1427589 | Valid | Command and Code Injection | None | 2021-12-21 | $50 | 40 |
| IDOR: leak buyer info & Publish/Hide foreign commentsAnalysed#1410498 | Valid | Insecure Direct Object Reference | High | 2022-03-31 | $1,250 | 47 |
| Email templates XSS by filterXSS bypassAnalysed#1404804 | Valid | Cross-site Scripting | High | 2022-05-25 | $1,250 | 51 |
| Blind XSS via Feedback form.Analysed#1339034 | Valid | Cross-site Scripting | High | 2022-05-03 | – | 57 |
| Stored XSS in Email Templates via linkAnalysed#1376672 | Valid | Cross-site Scripting | Medium | 2021-11-18 | $500 | 81 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.