Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| information disclose#135782 | Valid | Information Disclosure | – | 2016-07-06 | – | 1 |
| Reflected XSS in Backend search#136600 | Valid | Cross-site Scripting | – | 2016-06-11 | – | 2 |
| [Stored Cross-Site-Scripting] When search about Incoming ( Manual Jurnal )#154397 | Valid | Cross-site Scripting | – | 2016-08-05 | – | 2 |
| CSV Injection with the CSV export feature#130338 | Valid | Command and Code Injection | – | 2016-06-13 | – | 3 |
| Content Spoofing In Moneybird#133753 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 4 |
| Malicious File Upload#131028 | Valid | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 5 |
| Open Redirect vulnerability in moneybird.com#131728 | Valid | Open Redirect | – | 2016-07-28 | – | 6 |
| Webhook allows sending payload using insecure HTTP protocol#158541 | Valid | Cryptography | – | 2017-06-28 | – | 6 |
| Moneybird customers invoices leak in cacheable urls#247084 | Valid | No weakness recorded | – | 2017-08-16 | – | 6 |
| Stored XSS in Financial Account executing in Bank tab#131038 | Valid | Cross-site Scripting | – | 2016-06-13 | – | 7 |
| Stored XSS thru SVG upload#130591 | Valid | Cross-site Scripting | – | 2017-03-17 | – | 9 |
| [STORED XSS] in debtor reports of ,,invoices''#142893 | Valid | Cross-site Scripting | – | 2016-07-06 | – | 9 |
| Stored XSS on add project#996237 | Valid | Cross-site Scripting | Medium | 2020-10-05 | – | 12 |
| XXE issue#130661 | Valid | Command and Code Injection | – | 2017-03-17 | – | 13 |
| Logging out any user#147656 | Valid | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 13 |
| Stored Cross Site Scripting in Customer Name#211643 | Valid | Cross-site Scripting | – | 2017-03-17 | – | 13 |
| Stored XSS at Moneybird#251043 | Valid | Cross-site Scripting | – | 2017-08-17 | – | 13 |
| Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action#135989 | Valid | Authentication | – | 2016-06-13 | – | 15 |
| Pending MFA logins aren't immediatly expired after a password change#743518 | Valid | Authentication | Low | 2020-07-10 | – | 15 |
| Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure#269318 | Valid | Authentication | – | 2021-05-06 | – | 19 |
| IDOR in https://moneybird.com/user/accountant_company/edit(change company name)#726163 | Valid | Insecure Direct Object Reference | Low | 2021-09-21 | – | 22 |
| Open Redirection while saving User account Settings#288219 | Valid | Open Redirect | Medium | 2017-11-15 | – | 28 |
| Access control issue on invoice documents downloading feature.#1137218 | Valid | Access Control | Low | 2021-04-01 | – | 29 |
| No rate Limit#1145293 | Valid | No weakness recorded | Low | 2021-05-03 | – | 32 |
| Open Redirect through POST Request in OAuth#1129761 | Valid | Open Redirect | Low | 2021-09-21 | – | 34 |
| Enable 2FA without verifying the emailAnalysed#649533 | Valid | Denial of Service | Medium | 2019-10-25 | – | 149 |
| Bypass password reset rate limit protection at moneybird.com/passwordsAnalysed#723974 | Valid | Denial of Service | High | 2019-12-22 | – | 164 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.