Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Username Validation BypassAnalysed#3434156 | Valid | Authentication | Medium | 2025-11-26 | – | 64 |
| Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2Analysed#3091390 | Valid | Cross-site Scripting | Medium | 2025-10-22 | – | 49 |
| Login page password-guessing attackAnalysed#96115 | Valid | Misconfiguration and Insecure Design | – | 2024-04-19 | – | 47 |
| Reflected XSS in banner-acl.php and channel-acl.php via executionorderAnalysed#3470970 | Valid | Cross-site Scripting | Medium | 2026-01-14 | – | 39 |
| [revive-adserver] Reflected XSS in Banner Delivery Options via cap parameterAnalysed#3473696 | Valid | Cross-site Scripting | Medium | 2026-01-14 | – | 37 |
| Reflected XSS in afr.phpAnalysed#3468169 | Valid | Cross-site Scripting | Medium | 2026-01-14 | – | 36 |
| Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:Analysed#576504 | Valid | Authentication | High | 2019-05-21 | – | 31 |
| XML‑RPC login leak exposes valid session ID enabling unauthorized API accessAnalysed#3783738 | Valid | Access Control | Medium | 2026-06-25 | – | 28 |
| Reflected XSS on /admin/stats.phpAnalysed#1083376 | Valid | Cross-site Scripting | Medium | 2021-01-26 | – | 24 |
| Reflected XSS in account-preferences-plugin.phpAnalysed#3399191 | Valid | Cross-site Scripting | Medium | 2025-11-19 | – | 21 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.