Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
CSV injection in the credentials export#1131887	Valid	Misconfiguration and Insecure Design	None	2021-09-22	–	6
Used email confirmation link reveals the email address which is tied to it#1128358	Valid	Information Disclosure	None	2021-09-22	–	21
2fa can't be activated on app.pullrequest.com#2463069	Informative	Misconfiguration and Insecure Design	None	2024-07-11	–	25
Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml#1028396	Valid	Cross-site Scripting	None	2021-03-26	–	32
Bypassing Two-Factor Authentication via Account Deactivation and Password Reset#2543342	Duplicate	Access Control	None	2024-07-11	–	33
Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io#1028345	Valid	Open Redirect	None	2021-03-26	–	54
Register & create a ticket as somebody else on HackerOne Support#2082680	Valid	Misconfiguration and Insecure Design	None	2023-07-31	–	56
Stored XSS on https://events.hackerone.com#1028332	Valid	Cross-site Scripting	None	2021-03-26	–	59
LLM03: Training Data Poisoning via ASCII decoding#2370955	Informative	Injection and Smuggling	None	2024-05-28	–	61
Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)#995995	Valid	Cross-site Scripting	None	2020-11-09	–	84
Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer#2263294	Informative	Input Validation and Logic	None	2024-05-10	–	91
How the Arch Angel stole Live EventsAnalysed#2285198	Valid	No weakness recorded	None	2023-12-15	–	98
HackerOne making payments in USDC (Coinbase stable coin)Analysed#1220747	Valid	No weakness recorded	None	2021-06-17	–	201

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (965 analysed so far), which can be wrong. Data as of 2026-11-14.