Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| CSRF Based XSS @ https://██████████Analysed#1147949 | Valid | U.S. Dept Of Defense | Cross-site Scripting | Medium | 2021-06-30 | – | 12 |
| Account Takeover and Information update due to cross site request forgery via POST █████████/registration/my-account.cfmAnalysed#1626356 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2022-10-14 | – | 12 |
| Cross-site information assertion leak via Content Security PolicyAnalysed#16910 | Valid | Internet Bug Bounty | Information Disclosure | – | 2018-09-05 | – | 13 |
| Logging out any userAnalysed#147656 | Valid | Moneybird | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 13 |
| CSRF: add item to victim's cart automatically (starbucks.com - updatecart)Analysed#177472 | Valid | Starbucks | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 13 |
| CSRF on signup endpoint (auto-api.yelp.com)Analysed#178831 | Valid | Yelp | Cross-Site Request Forgery | – | 2017-03-01 | – | 13 |
| CSRF в m.vk.comAnalysed#300999 | Valid | VK.com | Cross-Site Request Forgery | Medium | 2021-11-05 | $100 | 13 |
| CSRF - Modify Project SettingsAnalysed#766533 | Valid | Stripo Inc | Cross-Site Request Forgery | Critical | 2020-02-03 | – | 13 |
| CSRF - Delete Account (Urgent)Analysed#799855 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2022-03-18 | – | 13 |
| Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKENAnalysed#915541 | Valid | Stripo Inc | Access Control | High | 2020-07-27 | – | 13 |
| CSRF to Cross-site Scripting (XSS)Analysed#1118521 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2021-03-24 | – | 13 |
| Login CSRF using Twitter OAuthAnalysed#2228 | Valid | Phabricator | Cross-Site Request Forgery | – | 2014-03-26 | – | 14 |
| CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protectionAnalysed#240098 | Valid | Ubiquiti Inc. | No weakness recorded | Critical | 2017-11-24 | – | 14 |
| Bypassing CSRF Token On Reply Message & Send MessageAnalysed#330122 | Valid | Reverb.com | No weakness recorded | Low | 2018-05-15 | – | 14 |
| CSRF on change video thumbnail at https://chaturbate.comAnalysed#416682 | Valid | Chaturbate | Cross-Site Request Forgery | Low | 2018-10-07 | – | 14 |
| XSSI: Quick Navigation Interface - leak of private page/post titlesAnalysed#495525 | Valid | Ian Dunn | Information Disclosure | Medium | 2019-02-15 | $50 | 14 |
| SSO through odnoklassniki uses http rather than httpsAnalysed#703759 | Valid | Bumble | Cryptography | Low | 2019-12-21 | $150 | 14 |
| csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.jsonAnalysed#796295 | Valid | Rockstar Games | Cross-Site Request Forgery | Low | 2020-07-07 | – | 14 |
| CSRF to Stored HTML injection at https://www.█████Analysed#1014593 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2020-12-03 | – | 14 |
| CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go publicAnalysed#136481 | Valid | Vimeo | Cross-Site Request Forgery | – | 2016-07-29 | – | 15 |
| CSRF to add admin [wordpress]Analysed#149589 | Valid | WordPress | Cross-Site Request Forgery | – | 2017-06-30 | – | 15 |
| Написать от имени любого пользователя на его стене, если он перейдет по ссылке. https://vk.com/al_video.phpAnalysed#211072 | Valid | VK.com | Access Control | Medium | 2017-06-17 | $200 | 15 |
| Posting to Twitter CSRF on php/post_twitter_authenticate.phpAnalysed#249234 | Valid | Eternal | Cross-Site Request Forgery | Low | 2017-08-19 | $50 | 15 |
| новенькое (старенькое upgreid) хакерство: делаем демократию во всем в контакте (XSS - на англиском)Analysed#316946 | Valid | VK.com | Cross-site Scripting | Critical | 2018-03-04 | – | 15 |
| Lack of CSRF protection on uberps.com makes every form vulnerable to CSRFAnalysed#343120 | Valid | Uber | Cross-Site Request Forgery | Medium | 2021-03-15 | $500 | 15 |
| XSS on www.██████ alerts and a number of other pagesAnalysed#450315 | Valid | U.S. Dept Of Defense | Cross-site Scripting | Medium | 2019-12-02 | – | 15 |
| csrf bypass using flash file + 307 redirect method at plugins endpointAnalysed#766205 | Valid | Stripo Inc | Cross-Site Request Forgery | Medium | 2020-02-10 | – | 15 |
| Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab InstancesAnalysed#970869 | Valid | GitLab | Command and Code Injection | Medium | 2022-02-10 | – | 15 |
| CSRF in https://███Analysed#1090838 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2021-04-20 | – | 15 |
| CSRF в виджетахAnalysed#1091296 | Valid | VK.com | Cross-Site Request Forgery | None | 2021-11-05 | $100 | 15 |
| crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc.Analysed#96662 | Valid | Bumble | Misconfiguration and Insecure Design | – | 2017-08-31 | – | 16 |
| Request Accepts without X-CSRFToken [ Header - Cookie ]Analysed#99857 | Valid | drchrono | Authentication | – | 2016-08-31 | – | 16 |
| CSRF logs the victim into attacker's accountAnalysed#339352 | Valid | Unikrn | Cross-Site Request Forgery | Medium | 2018-04-19 | – | 16 |
| Проверяем принадлеженость email и номера телефона к определенному юзеру / CSRF на смену номера для некоторых пользователейAnalysed#388236 | Valid | VK.com | Cross-Site Request Forgery | High | 2019-01-28 | $300 | 16 |
| Отсутствие CSRF ключа на функции Закрытый Профиль.Analysed#448928 | Valid | ok.ru | Cross-Site Request Forgery | Critical | 2020-05-15 | – | 16 |
| CSRF for deleting videosAnalysed#998979 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2020-12-23 | – | 16 |
| Administration Authentication Bypass on https://█████Analysed#1146600 | Valid | U.S. Dept Of Defense | Authentication | Critical | 2021-04-20 | – | 16 |
| CSRF to ATO at https://█████/user/account [HtUS]Analysed#1624421 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | High | 2023-01-06 | $500 | 16 |
| Full account takeover using CSRF and password resetAnalysed#6910 | Valid | IRCCloud | Cross-Site Request Forgery | – | 2014-04-14 | – | 17 |
| CSRF Проверить является ли пользователь админом группы.Analysed#250386 | Valid | VK.com | Cross-Site Request Forgery | – | 2017-09-14 | $100 | 17 |
| CSRF log victim into the attacker accountAnalysed#293016 | Valid | Unikrn | Cross-Site Request Forgery | High | 2018-04-10 | – | 17 |
| [chaturbate.com] - CSRF Vulnerability on image uploadAnalysed#401483 | Valid | Chaturbate | No weakness recorded | Medium | 2018-09-19 | $300 | 17 |
| Self XSS combine CSRF at https://████████/index.phpAnalysed#485684 | Valid | U.S. Dept Of Defense | Cross-site Scripting | Medium | 2020-05-27 | – | 17 |
| Chained vulnerabilities create DOS attack against users on desafio5estrelas.comAnalysed#624645 | Valid | Uber | Cross-Site Request Forgery | Low | 2021-03-30 | $1,000 | 17 |
| Widespread CSRF on authenticated POST endpointsAnalysed#1309435 | Valid | UPchieve | Cross-Site Request Forgery | High | 2022-02-13 | – | 17 |
| Twitter Disconnect CSRFAnalysed#111216 | Valid | Shopify | Cross-Site Request Forgery | – | 2016-02-01 | – | 18 |
| Possible CSRF during joining report as participantAnalysed#148517 | Valid | HackerOne | Cross-Site Request Forgery | – | 2016-07-12 | – | 18 |
| [www.zomato.com] Privilege Escalation - Control reviews - /████dashboard_handler.phpAnalysed#300099 | Valid | Eternal | Access Control | – | 2018-03-29 | $300 | 18 |
| CSRF Add user templatesAnalysed#301919 | Valid | Mavenlink | Cross-Site Request Forgery | Medium | 2019-02-27 | – | 18 |
| Ability to perform various POST requests on quantopian.com as a different user - insecure by design.Analysed#837328 | Valid | Quantopian | Misconfiguration and Insecure Design | Low | 2022-12-21 | $1,050 | 18 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.