Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF on delete friend requests - Not protected with CSRF Token#1408745 | Duplicate | Cross-Site Request Forgery | None | 2021-11-26 | – | 9 |
| Host Header Injection Attack - www.xnxx.com#1630073 | Informative | Misconfiguration and Insecure Design | None | 2022-11-08 | – | 14 |
| Self-XSS on Suggest Tag dialog box#1761505 | Valid | Cross-site Scripting | Low | 2022-11-08 | $50 | 15 |
| API Data Leakage Vulnerability Report - `xvcams.com`#2979153 | N/A | Information Disclosure | None | 2025-02-09 | – | 33 |
| Script breaking tag (Forces website to render blank) (Informative)Analysed#1355537 | Valid | Other weaknesses | Low | 2021-10-23 | $150 | 36 |
| Error Page Content Spoofing or Text Injection#2979148 | Informative | Misconfiguration and Insecure Design | – | 2025-02-07 | – | 37 |
| Error Page Content Spoofing or Text InjectionAnalysed#2968559 | Valid | Misconfiguration and Insecure Design | Low | 2025-02-06 | – | 46 |
| Unauthenticated API Access Exposing Premium Content and Financial Data#2979176 | N/A | Information Disclosure | None | 2025-02-09 | – | 46 |
| No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)Analysed#1392287 | Valid | No weakness recorded | Low | 2021-11-23 | $100 | 67 |
| Enable 2FA without verifying the email#3016540 | Duplicate | Access Control | Low | 2025-05-09 | – | 70 |
| Stored XSS via SMTP Error MessageAnalysed#2956266 | Valid | Cross-site Scripting | Low | 2025-01-24 | $250 | 86 |
| Lack of Rate Limiting on Account Creation EndpointAnalysed#2915502 | Valid | No weakness recorded | Low | 2025-01-16 | $200 | 110 |
| Open redirect#2957962 | Spam | Open Redirect | None | 2025-02-06 | – | 143 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.