Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Html injection in event DescriptionAnalysed#2215418	Valid	Input Validation and Logic	Low	2024-01-29	–	55
Users can access exams in course without having to subscribe to PREMIUMAnalysed#1892888	Valid	Access Control	Medium	2024-01-10	–	64
Attackers can Upgrade and claim offer on the Premium Trial Subscription with a total price of IDR0.00 from the original IDR7,022,061.82Analysed#2131224	Valid	Input Validation and Logic	High	2024-06-18	–	70
Employee-only Area BypassAnalysed#2299571	Valid	Access Control	Medium	2024-02-19	–	77
Forced OAuth authorization using button ID in hash and holding spaceAnalysed#2649615	Valid	Authentication	Medium	2024-12-17	–	79
Stored XSS on LinkedIn App via iframe tag in ArticleAnalysed#2212950	Valid	Cross-site Scripting	Critical	2024-02-28	–	93
An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.Analysed#2291999	Valid	Insecure Direct Object Reference	High	2024-03-12	–	94
Can see phone numbers of others by providing mail addressAnalysed#2534458	Valid	Information Disclosure	High	2024-11-13	–	111

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.