Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
XSS in steam react chat clientAnalysed#409850	Valid	Cross-site Scripting	Critical	2019-01-07	$7,500	499
SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127	Valid	SQL Injection	Critical	2018-07-27	$25,000	410
[help.steampowered.com] Account takeover bruteforcing SteamGuardAnalysed#407971	Valid	Input Validation and Logic	High	2019-01-23	$2,500	112
ImageMagick GIF coder vulnerability leading to memory disclosureAnalysed#315256	Valid	Information Disclosure	Medium	2018-07-02	–	86
Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URLAnalysed#949361	Valid	Command and Code Injection	Critical	2024-07-30	–	59
Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_largeAnalysed#840243	Valid	Command and Code Injection	Critical	2024-07-30	–	53
Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifierAnalysed#926169	Valid	Command and Code Injection	Critical	2024-07-30	–	47
WG call injection in /economy/contextcommandAnalysed#652649	Valid	Command and Code Injection	Critical	2024-07-30	–	47
SQL injection in /errors/viewbuild/Analysed#690349	Valid	SQL Injection	Critical	2024-07-30	–	41
Buffer overflows in demo parsingAnalysed#350119	Valid	Memory Corruption	Medium	2018-08-28	–	33
Hidden scheduled partner events are propagated to Steam clients in CMsgClientClanStateAnalysed#780167	Valid	Information Disclosure	Medium	2020-03-20	–	31
/applications/dpc_(get\|post) provide full access to api.steampowered.com with the Dota2 API keyAnalysed#674800	Valid	Server-Side Request Forgery	High	2024-07-30	–	30
LFI in pChart php libraryAnalysed#288298	Valid	File and Path Handling	High	2018-05-09	–	29
Privilege Escalation vulnerability in steam's Remote Play feature leads to arbitrary kernel-mode driver installationAnalysed#852091	Valid	Access Control	Medium	2021-09-21	–	23
RCE on partner.steampowered.comAnalysed#518348	Valid	Command and Code Injection	Critical	2024-07-30	–	19

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.