Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Remote Code Execution (Reverse Shell) - File ManagerAnalysed#768322 | Valid | Concrete CMS | Command and Code Injection | Medium | 2020-07-21 | – | 114 |
| Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerAnalysed#2336236 | Valid | GitHub | No weakness recorded | High | 2024-09-13 | – | 71 |
| Ability to escape database transaction through SQL injection, leading to arbitrary code executionAnalysed#1663299 | Valid | HackerOne | SQL Injection | High | 2022-08-09 | – | 29 |
| OS Command Injection in Nexus Repository Manager 2.xAnalysed#654888 | Valid | Central Security Project | Command and Code Injection | Critical | 2019-08-20 | – | 28 |
| PHP Code Injection through "previewBlock()" methodAnalysed#1092574 | Valid | Invision Power Services, Inc. | Command and Code Injection | High | 2021-05-28 | – | 26 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.