Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL Injection at https://████ via ███ parameterAnalysed#1935151 | Valid | SQL Injection | Critical | 2023-04-24 | – | 74 |
| 明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Analysed#2642615 | Valid | Cryptography | High | 2025-07-08 | – | 71 |
| SSRF on http://www.███████/crossdomain.php via url parameterAnalysed#971590 | Valid | Server-Side Request Forgery | Critical | 2022-10-06 | – | 42 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,444 analysed so far), which can be wrong. Data as of 2026-11-15.