Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open redirect in switch account functionality#390663 | Valid | Open Redirect | Low | 2019-04-23 | – | 3 |
| Cross Site Scripting and Open Redirect in affiliate-preview.php file#819362 | Valid | Open Redirect | Low | 2021-01-20 | – | 4 |
| Reflected XSS on Zones > Invocation Code#178611 | Valid | Cross-site Scripting | Low | 2017-08-02 | – | 7 |
| Open redirection bypass in /www/admin/campaign-modify.php#794144 | Valid | Open Redirect | Low | 2020-03-12 | – | 7 |
| Weak Forgot Password implementationAnalysed#176116 | Valid | Authentication | Low | 2017-08-02 | – | 17 |
| Stored XSS on inventory-retrieve.phpAnalysed#3399809 | Valid | Cross-site Scripting | Low | 2025-11-19 | – | 17 |
| INI Format string injection in Revive Adserver 6.0.4 settingsAnalysed#3445332 | Valid | Memory Corruption | Low | 2026-01-14 | – | 19 |
| Stored-XSS in Banner Name fieldAnalysed#3404968 | Valid | Cross-site Scripting | Low | 2025-11-19 | – | 21 |
| bypass old password with array in /admin/account-user-email.phpAnalysed#792895 | Valid | Memory Corruption | Low | 2020-03-12 | – | 22 |
| Improper sanitisation of input in the settings could cause DoSAnalysed#3399218 | Valid | Input Validation and Logic | Low | 2025-11-19 | – | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.