Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Denial of service via cache poisoningAnalysed#409370	Valid	Denial of Service	Medium	2018-12-22	$2,500	253
SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterAnalysed#435066	Valid	SQL Injection	Critical	2018-11-30	–	174
h1-202 leaderboard photo discloses local wifi passwordAnalysed#329798	Valid	Authentication	Medium	2018-03-25	–	145
Blind SSRF on errors.hackerone.net due to Sentry misconfigurationAnalysed#374737	Valid	Server-Side Request Forgery	Low	2018-07-04	$3,500	143
Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comAnalysed#374919	Valid	Cross-site Scripting	Medium	2018-08-04	–	129
Team object in GraphQL disclosed total number of whitelisted hackersAnalysed#342978	Valid	Information Disclosure	Medium	2018-05-12	$2,500	93
Unauthenticated user can upload an attachment to the last updated report draftAnalysed#419896	Valid	Memory Corruption	High	2018-10-09	–	87
Improper UUID validation results in bypass of #419896Analysed#423073	Valid	Input Validation and Logic	High	2018-10-25	–	82
HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse formsAnalysed#298265	Valid	No weakness recorded	None	2018-03-13	–	65
Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profileAnalysed#347693	Valid	Information Disclosure	Medium	2018-05-08	$2,500	64
HackerOne customer submitted sensitive link to VirusTotal, exposing confidential informationAnalysed#378122	Valid	Information Disclosure	None	2018-07-26	–	60
Team object exposes amount of participants in a private program to non-invited usersAnalysed#380317	Valid	Information Disclosure	Medium	2018-07-20	–	59
Open Redirection in index.php pageAnalysed#320376	Valid	Open Redirect	None	2018-03-07	–	53
Domain spoofing in redirect page using RTLOAnalysed#299403	Valid	Open Redirect	Low	2018-01-30	–	48
HackerOne support disclosing report state without checking user identityAnalysed#356566	Valid	No weakness recorded	Low	2018-06-02	$500	43
Invitation token leaks to https://bat.bing.comAnalysed#301526	Valid	Information Disclosure	Low	2018-01-11	–	36
Can read features from any userAnalysed#316810	Valid	Information Disclosure	Medium	2018-03-12	$250	28
Program profile_metrics.json contains time to triage for deptofdefense even it's turned offAnalysed#318399	Valid	Information Disclosure	None	2018-03-09	$250	27
Self DOM-Based XSS in www.hackerone.comAnalysed#406587	Valid	Cross-site Scripting	Low	2018-11-08	–	23

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.