Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Remote Code Execution (RCE) in DoD WebsitesAnalysed#235605 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2018-04-17 | – | 17 |
| Remote Command Execution in a internal server to get the flag fileAnalysed#415682 | Valid | h1-5411-CTF | Command and Code Injection | Critical | 2018-10-22 | – | 17 |
| Squid as reverse proxy RCE and data leakAnalysed#778610 | Valid | Internet Bug Bounty | Memory Corruption | Critical | 2021-08-26 | – | 17 |
| bunyan - RCE via insecure command formattingAnalysed#902739 | Valid | Node.js third-party modules | Command and Code Injection | High | 2020-06-27 | – | 17 |
| Read-Only user can execute arbitraty shell commands on AirOSAnalysed#119317 | Valid | Ubiquiti Inc. | Command and Code Injection | – | 2016-08-05 | – | 18 |
| RCE on ███████ [CVE-2021-26084]Analysed#1327701 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-12-21 | – | 18 |
| GNU Bourne-Again Shell (Bash) 'Shellshock' VulnerabilityAnalysed#29839 | Valid | Internet Bug Bounty | No weakness recorded | – | 2014-10-01 | – | 19 |
| RCE on partner.steampowered.comAnalysed#518348 | Valid | Valve | Command and Code Injection | Critical | 2024-07-30 | – | 19 |
| Web Server Predictable Session ID on EdgeSwitchAnalysed#774393 | Valid | Ubiquiti Inc. | Authentication | High | 2021-05-23 | – | 19 |
| Shell Injection via Web Management Console (dl-fw.cgi)Analysed#121940 | Valid | Ubiquiti Inc. | Command and Code Injection | – | 2016-10-15 | – | 20 |
| CSV Injection https://hub.grab.comAnalysed#244292 | Valid | Grab | Command and Code Injection | Medium | 2017-10-27 | – | 20 |
| Pre-Auth Blind NoSQL Injection leading to Remote Code ExecutionAnalysed#1130721 | Valid | Rocket.Chat | No weakness recorded | Critical | 2021-05-18 | – | 20 |
| Bypass incomplete fix of CVE-2024-27980Analysed#2461831 | Valid | Node.js | Command and Code Injection | High | 2024-07-09 | – | 20 |
| Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://███Analysed#678496 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2019-12-02 | – | 21 |
| Read-Only user can execute arbitraty shell commands on AirOSAnalysed#128750 | Valid | Ubiquiti Inc. | Command and Code Injection | – | 2016-08-05 | – | 22 |
| Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714)Analysed#143966 | Valid | Internet Bug Bounty | No weakness recorded | – | 2016-05-03 | – | 22 |
| CRLF injection & SSRF in git:// protocal lead to arbitrary code executionAnalysed#441090 | Valid | GitLab | Server-Side Request Forgery | High | 2020-11-23 | – | 22 |
| CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dagAnalysed#1671140 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2022-09-23 | – | 22 |
| Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip FlagsAnalysed#3633123 | Valid | AWS VDP | Command and Code Injection | High | 2026-09-16 | – | 23 |
| Apache solr RCE via velocity templateAnalysed#822002 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2021-01-12 | – | 24 |
| Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]Analysed#810778 | Valid | MTN Group | Command and Code Injection | Critical | 2021-04-25 | – | 25 |
| Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████Analysed#1339430 | Valid | Sony | Command and Code Injection | Critical | 2022-07-06 | – | 26 |
| Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50Analysed#1404731 | Valid | Internet Bug Bounty | File and Path Handling | Critical | 2021-11-19 | $1,000 | 26 |
| Code exec on Github runner via Pull request nameAnalysed#2471956 | Valid | Linux Foundation Decentralized Trust | Command and Code Injection | Medium | 2024-04-28 | – | 26 |
| [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 usersAnalysed#197958 | Valid | Ubiquiti Inc. | Command and Code Injection | Medium | 2017-07-21 | – | 27 |
| Readonly to Root Privilege Escalation on EdgeSwitchAnalysed#796414 | Valid | Ubiquiti Inc. | Command and Code Injection | High | 2021-05-23 | – | 27 |
| Argument/Code Injection via ActiveStorage's image transformation functionalityAnalysed#1154034 | Valid | Ruby on Rails | Command and Code Injection | High | 2023-07-28 | – | 27 |
| Attention! Remote Code Execution at http://wpt.ec2.shopify.com/Analysed#73567 | Valid | Shopify | Command and Code Injection | – | 2015-07-16 | – | 28 |
| NET::Ftp allows command injection in filenamesAnalysed#294462 | Valid | Ruby | Command and Code Injection | Low | 2017-12-19 | – | 28 |
| OS Command Injection in Nexus Repository Manager 2.xAnalysed#654888 | Valid | Central Security Project | Command and Code Injection | Critical | 2019-08-20 | – | 28 |
| Bundler's RCE with response using MarshalAnalysed#1119120 | Valid | RubyGems | Deserialization and Object Injection | – | 2024-03-12 | – | 28 |
| RCE on a Department of Defense websiteAnalysed#184279 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2017-01-11 | – | 29 |
| Remote code execution on an Army websiteAnalysed#188284 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2017-01-12 | – | 31 |
| Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)Analysed#696276 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2024-06-18 | – | 31 |
| RCE in profile picture uploadAnalysed#135072 | Valid | HackerOne | Command and Code Injection | – | 2016-06-08 | – | 32 |
| Vulnerability in project import leads to arbitrary command executionAnalysed#378148 | Valid | GitLab | Command and Code Injection | Critical | 2018-08-22 | – | 32 |
| Command injection in GitHub Actions ContainerStepHostAnalysed#1637621 | Valid | GitHub | Injection and Smuggling | None | 2022-11-03 | $4,000 | 32 |
| RCE via File Upload with a Null Byte Truncated File Extension at https://██████/Analysed#2054184 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-12-21 | – | 33 |
| OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)Analysed#688270 | Valid | Central Security Project | Command and Code Injection | Critical | 2019-10-29 | – | 34 |
| Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionAnalysed#3874004 | Valid | Weblate | Command and Code Injection | High | 2026-09-15 | – | 34 |
| Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hookAnalysed#299473 | Valid | GitLab | Server-Side Request Forgery | High | 2018-04-27 | $750 | 36 |
| Command injection in PathnameAnalysed#449482 | Valid | Ruby | Command and Code Injection | – | 2019-04-01 | – | 36 |
| RCE via ssh:// URIs in multiple VCSAnalysed#260005 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2017-09-21 | – | 39 |
| Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████Analysed#695005 | Valid | U.S. Dept Of Defense | Information Disclosure | Critical | 2021-07-29 | – | 39 |
| RCE in ███ [CVE-2021-26084]Analysed#1327769 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-12-21 | – | 39 |
| POOL_UPGRADE request handler may allow an unauthenticated attacker to remotely execute code on every node in the network.Analysed#1705717 | Valid | Linux Foundation Decentralized Trust | Command and Code Injection | Critical | 2022-10-20 | $2,000 | 39 |
| Command Injection using malicious hostname in expanded proxycommandAnalysed#2293731 | Valid | Internet Bug Bounty | Command and Code Injection | Low | 2024-02-28 | $540 | 39 |
| Command injection on Phabricator instance with an evil hg branch nameAnalysed#288704 | Valid | Phabricator | Command and Code Injection | Critical | 2017-11-11 | – | 41 |
| RCE by parsing `.rdoc_options` in RDocAnalysed#1187477 | Valid | Ruby | Command and Code Injection | – | 2024-07-03 | – | 41 |
| Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.comAnalysed#410334 | Valid | IBM | Command and Code Injection | High | 2022-02-04 | – | 42 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.