Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Google dork lead to unsubscribe anyone from all Banfield emails#2055081	Valid	Access Control	Low	2023-08-30	–	12
Jolokia Reflected XSS#1714563	Valid	Cross-site Scripting	Medium	2022-10-27	–	13
Information Exposure Through Directory Listing#1948562	Valid	Information Disclosure	High	2023-06-23	–	13
CRLF Inection at `██████████`#1943013	Valid	Injection and Smuggling	Low	2023-06-23	–	14
Stored XSS via ' profile ' at ███#1921606	Valid	Cross-site Scripting	Medium	2023-06-23	–	16
' Full Account Takeover ' at █████#1959540	Valid	Access Control	Critical	2023-06-23	–	19
███████ ' can delete any animal from other account ' at ██████████#1947376	Valid	Insecure Direct Object Reference	Medium	2023-06-23	–	21
Information Exposure due to enabled debug mode#2243003	Valid	No weakness recorded	Low	2024-11-25	–	22
CSRF to delete a pet#2029753	Valid	Cross-Site Request Forgery	Medium	2023-08-30	–	25
Reflected XSS on formaction parameter#2089895	Valid	Cross-site Scripting	Medium	2024-11-19	–	25
"CSRF Vulnerability in ███████ Website Allows Attackers to Change User Profile Picture at ███████"#2144870	Valid	No weakness recorded	Medium	2023-11-15	–	26
████ ' can add animal to other account ' at ██████#1965640	Valid	Insecure Direct Object Reference	Medium	2023-06-22	–	27
sensitive data-creds for database - private key#2396630	Valid	Cryptography	Medium	2024-11-19	–	27
Customer Data Exposure via Insecure Endpoint of coupon#2828720	Valid	Information Disclosure	Medium	2025-05-27	–	28
No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATO#3174778	Valid	Authentication	Medium	2026-02-24	–	28
No CSRF protection when adding an item to cart#2190062	Valid	Cross-Site Request Forgery	Low	2024-01-30	–	29
Blind SQL Injection on █████ via URI Path#2266081	Valid	SQL Injection	Critical	2024-02-14	–	29
CSRF resulting in adding pet at ███████#2313478	Valid	Cross-Site Request Forgery	Low	2024-06-25	–	29
███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration#3066548	Valid	Information Disclosure	Medium	2026-02-24	–	29
CVE-2022-21371: Oracle WebLogic Server Local File Inclusion#2387600	Valid	No weakness recorded	High	2024-03-04	–	30
████ ' can change any account email and cannot retrieve his account and access it ' at ███#1952771	Valid	Insecure Direct Object Reference	High	2023-06-23	–	32
CSRF in Delete Pet Function#2445106	Valid	Cross-Site Request Forgery	Medium	2024-11-19	–	32
Order More Than Maximum Allowed Quantity#3185001	Valid	Input Validation and Logic	–	2025-09-02	–	32
Sensitive Information Exposed at █████#2308654	Valid	Information Disclosure	High	2024-01-30	–	33
Reflected xss on ████████#2389897	Valid	Cross-site Scripting	Medium	2024-06-25	–	33
Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint#3376598	Valid	Cryptography	Medium	2026-02-24	–	35
phpinfo() exposed on ██████████#2666151	Valid	Misconfiguration and Insecure Design	–	2024-11-21	–	36
massive PII leakage for ███████#2887506	Valid	Information Disclosure	Medium	2025-05-12	–	36
RXSS in ███ via S parameter#2307913	Valid	Cross-site Scripting	Medium	2024-11-19	–	38
debug.log File Exposure that exposes (user/████) username and password at █████████#2122938	Valid	Cryptography	High	2023-11-15	–	39
RXSS on ████ via q parameter#2166843	Valid	Cross-site Scripting	Low	2024-11-21	–	39
Client Side Template Injection to Stored XSS in Image Collection#2234564	Valid	Cross-site Scripting	High	2024-02-14	–	39
subdomain takeover at █████████#2106886	Valid	Misconfiguration and Insecure Design	High	2023-11-15	–	40
RXSS on stores on *█████████/visitorRegistration.pml via destination parameter#2189797	Valid	Cross-site Scripting	Medium	2025-09-02	–	40
Users Data Exposure via Insecure Endpoint#2828608	Valid	Information Disclosure	Medium	2025-05-12	–	40
debug.log leaked [█████████]#3063026	Valid	Information Disclosure	Low	2025-05-12	–	40
Account takeover using reset password link#2341038	Valid	Open Redirect	Medium	2024-06-25	–	41
SQLi at █████ parameter#3277276	Valid	SQL Injection	Critical	2026-02-24	–	42
IDOR in one subdomain of █████████ -> change information of pets without athorization!#2073950	Valid	Insecure Direct Object Reference	Medium	2024-02-14	–	45
IDOR to account takeover on POST to █████████ by changing member_id parameter#2132183	Valid	Insecure Direct Object Reference	Critical	2024-01-30	–	45
unsubscribe anyone from all ████████ emails @ █████#2354888	Valid	Access Control	Low	2024-11-25	–	45
Datadog api keys exposed can be used to do all the read and write access to the instance#2307933	Valid	Information Disclosure	Critical	2024-01-25	–	47
Sqli on ██████ search functionality#2453475	Valid	SQL Injection	Medium	2024-06-25	–	47
Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses#3360293	Valid	Information Disclosure	Medium	2026-02-24	–	49
Bug Report #23JAN135 (subdomain takeover via shopify )#1851886	Valid	Access Control	High	2025-09-02	–	50
phpinfo() exposed on ██████████#2641211	Valid	Misconfiguration and Insecure Design	Medium	2024-11-21	–	51
Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████#2262554	Valid	Authentication	Critical	2024-01-30	–	53
RXSS on ████ via configUrl parameter#2684274	Valid	Cross-site Scripting	Low	2024-11-26	–	53
change part of personal information all users#2828693	Valid	Access Control	Critical	2025-05-12	–	53
unauthorized access and add user and change personal information all users#2828641	Valid	Access Control	Critical	2025-05-27	–	54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,683 analysed so far), which can be wrong. Data as of 2026-11-15.