Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DNSSEC Zone Walk using NSEC Records#228471 | Informative | Information Disclosure | – | 2018-01-30 | – | 1 |
| CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org#231062 | Informative | Misconfiguration and Insecure Design | – | 2017-05-23 | – | 1 |
| No rate limit or captcha to identify humans#257384 | Valid | Misconfiguration and Insecure Design | – | 2017-09-15 | – | 1 |
| Improper Password Reset Policy on https://hosted.weblate.org/#223362 | Valid | Misconfiguration and Insecure Design | – | 2017-05-17 | – | 2 |
| hosted.weblate.org: X-XSS-Protection not enabled#223396 | Valid | Cross-site Scripting | – | 2017-05-17 | – | 2 |
| Abuse of Api that causes spamming users and possible DOS due to missing rate limit#223557 | Valid | No weakness recorded | – | 2017-05-17 | – | 2 |
| demo.weblate.org is vulnerable to SWEET32 Vulnerability#223653 | Valid | Cryptography | – | 2017-05-17 | – | 2 |
| weblate.org: X-XSS-Protection not enabled#223723 | Valid | Cross-site Scripting | – | 2017-05-17 | – | 2 |
| Specify maximal length in new comment#223931 | Valid | Misconfiguration and Insecure Design | – | 2017-05-17 | – | 2 |
| Specify maximal length in translation#224015 | Valid | Misconfiguration and Insecure Design | – | 2017-05-17 | – | 2 |
| full path disclosure at hosted.weblate.org/admin/accounts/profile/#225495 | Valid | File and Path Handling | – | 2017-05-17 | – | 2 |
| Incorrect HTTPS Certificate#225540 | Valid | Cryptography | – | 2017-06-16 | – | 2 |
| ClickJacking on Debug#225555 | Valid | Misconfiguration and Insecure Design | – | 2017-06-16 | – | 2 |
| Facebook share URL should be HTTPS#225769 | Valid | No weakness recorded | – | 2017-06-16 | – | 2 |
| Already Registered Email Disclosure#223343 | Valid | Information Disclosure | – | 2017-05-17 | – | 3 |
| CSRF - Changing the full name / adding a secondary email identity of an account via a GET request#223367 | Valid | Cross-Site Request Forgery | – | 2017-06-02 | – | 3 |
| Directory Listing#223384 | Valid | Cryptography | – | 2017-06-16 | – | 3 |
| Notify user about password change#223609 | Valid | Authentication | – | 2017-05-17 | – | 3 |
| Null Password - Setting a new password doesn't check for empty spaces#223618 | Valid | Authentication | – | 2017-05-18 | – | 3 |
| Self XSS at translation page through Editor Link at demo.weblate.org#223692 | Valid | Cross-site Scripting | – | 2017-05-17 | – | 3 |
| Open redirect in Signing in via Social Sites#223718 | Duplicate | Open Redirect | – | 2017-05-17 | – | 3 |
| Setting a password with a single character#223851 | Valid | Authentication | – | 2017-05-18 | – | 3 |
| HttpOnly Flag not set#224006 | Valid | Misconfiguration and Insecure Design | – | 2017-05-18 | – | 3 |
| Email spoofing at weblate.org#224186 | Valid | No weakness recorded | – | 2017-06-16 | – | 3 |
| 7BO: Binary Option Robot URL should be HTTPS#225722 | Valid | No weakness recorded | – | 2017-06-16 | – | 3 |
| Captcha bypass at registration#229584 | Informative | No weakness recorded | – | 2017-06-28 | – | 3 |
| Adding Email lacks Password validation#229869 | Valid | No weakness recorded | – | 2017-06-28 | – | 3 |
| Password token validation in https://demo.weblate.org/#229987 | Valid | Authentication | – | 2017-06-27 | – | 3 |
| Improper validation of unicode characters#2#279945 | Informative | No weakness recorded | – | 2020-07-26 | – | 3 |
| hosted.weblate.org display of unfiltered results#1454552 | Informative | No weakness recorded | – | 2022-01-21 | – | 3 |
| No expiration of session ID after Password change#223327 | Valid | Authentication | – | 2017-05-17 | – | 4 |
| [demo.weblate.org] Stored Self-XSS via Editor Link in Profile#223331 | Valid | Cross-site Scripting | – | 2017-05-17 | – | 4 |
| Content Spoofing in error message#223456 | Valid | Misconfiguration and Insecure Design | – | 2017-05-17 | – | 4 |
| Existing sessions valid after removing third party auth#223475 | Valid | Authentication | – | 2017-06-16 | – | 4 |
| User Enumeration when adding email to account#223531 | Valid | No weakness recorded | – | 2017-05-17 | – | 4 |
| Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form#223542 | Valid | No weakness recorded | – | 2017-05-17 | – | 4 |
| Missing DMARC on weblate.org#223545 | Valid | No weakness recorded | – | 2017-05-17 | – | 4 |
| Content Spoofing#223630 | Duplicate | No weakness recorded | – | 2017-05-17 | – | 4 |
| Email verification over an unencrypted channel#224287 | Valid | Cryptography | – | 2017-05-17 | – | 4 |
| CSV Injection with the CVS export feature - Glossary#224291 | Valid | Command and Code Injection | – | 2017-05-17 | – | 4 |
| Bypassing captcha in registration on Hosted site#224342 | Informative | Denial of Service | – | 2017-07-03 | – | 4 |
| Improper validation of unicode characters#229483 | Valid | No weakness recorded | – | 2017-06-19 | – | 4 |
| No notificatoin sent on email after account deletion.#229909 | Valid | No weakness recorded | – | 2017-06-02 | – | 4 |
| Weblate- Banner Grabbing-Ngnix Server version#230633 | Valid | No weakness recorded | – | 2017-06-05 | – | 4 |
| CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org#230863 | Valid | Cross-Site Request Forgery | – | 2017-06-02 | – | 4 |
| API Does Not Apply Access Controls to Translations#232994 | Valid | Access Control | – | 2017-06-02 | – | 4 |
| No filteration of null characters in name field#242945 | Valid | Misconfiguration and Insecure Design | – | 2017-07-27 | – | 4 |
| Previous password could set as new password#243616 | Valid | No weakness recorded | – | 2017-08-21 | – | 4 |
| Error Message When Changing Username#243664 | Valid | Input Validation and Logic | – | 2017-08-17 | – | 4 |
| [debian.weblate.org]-Missing SPF Record#245518 | Valid | Misconfiguration and Insecure Design | – | 2017-08-24 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.