Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS#112025 | Informative | Cross-site Scripting | – | 2016-02-22 | – | – |
| information disclosure#78765 | Valid | Information Disclosure | – | 2016-02-07 | – | 1 |
| Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modification#95640 | Informative | Cross-site Scripting | – | 2016-02-24 | – | 2 |
| Misconfigured SPF Record Flag#60260 | Informative | Misconfiguration and Insecure Design | – | 2016-02-22 | – | 3 |
| Authentication Data are not Clearing#119262 | Valid | Authentication | – | 2016-04-13 | – | 4 |
| NON VALIDATION OF SESSIONS AFTER PASSWORD CHANGE#164239 | Duplicate | Authentication | – | 2016-09-16 | – | 6 |
| Ability to add pishing links in discusion ," Bypassing uneductional Links add "#62301 | Valid | Information Disclosure | – | 2016-07-09 | – | 10 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.