Leak of Platform Authentication credentials via Repeater Analysed #302651 Valid Information Disclosure Low 2018-06-13 $200 15 The role "CI-driven scan initiator" provides excessive read access Analysed #2276148 Valid Access Control Low 2026-01-02 – 28 UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding Authen Analysed #3717354 Valid Other weaknesses None 2026-06-15 – 28 JSBeautifier BApp: Race condition leads to memory disclosure #187134 Valid Memory Corruption High 2016-12-07 – 32 XSS in IE11 on portswigger.net via Flash Analysed #182160 Valid Cross-site Scripting – 2016-11-30 – 33 Redirection in Repeater & Intruder Tab Analysed #1541301 Valid Open Redirect Low 2022-08-11 $150 36 burp does not validate the common name of the presented collaborator server certificate Analysed #337680 Valid Cryptography Medium 2018-06-13 $1,500 39 Changing the administrator password via admin console does not invalidate other sessions Analysed #2279041 Valid Authentication Low 2024-05-20 – 41 RCE in 'Copy as Node Request' BApp via code injection Analysed #1167530 Valid Command and Code Injection None 2021-04-22 – 51 A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts Analysed #2279010 Valid Access Control Low 2024-05-20 – 51 Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authentication Analysed #3972558 Valid No weakness recorded Medium 2026-10-15 $1,000 58 SMTP interaction theft via MITM Analysed #953219 Valid Cryptography Medium 2020-11-04 – 78 cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party Analysed #2733994 Valid Information Disclosure Low 2025-03-13 $200 81 Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption Analysed #3625600 Valid No weakness recorded Low 2026-05-05 $200 92 HTML Injection in DAST Trial Request Form Confirmation Email – PortSwigger Analysed #3556892 Valid No weakness recorded Low 2026-02-26 $200 93 CSP bypass on PortSwigger.net using Google script resources Analysed #2279346 Valid Cross-site Scripting Medium 2024-02-18 – 113 HTML Injection in Swing can disclose netNTLM hash or cause DoS Analysed #1054382 Valid Information Disclosure Medium 2021-03-29 $1,000 117 Build fetches jars over HTTP Analysed #506161 Valid Cryptography Medium 2019-06-10 $1,000 135 DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool Analysed #3176157 Valid Server-Side Request Forgery None 2025-10-08 – 144 [portswigger.net] Path Traversal al /cms/audioitems Analysed #2424815 Valid File and Path Handling High 2024-04-04 – 146 RCE of Burp Scanner / Crawler via Clickjacking Analysed #1274695 Valid Command and Code Injection High 2023-10-10 $3,000 172 Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling Analysed #3712279 Valid File and Path Handling High 2026-06-14 $5,000 176