Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Confidential data of users and limited metadata of programs and reports accessible via GraphQLAnalysed#489146 | Valid | HackerOne | Information Disclosure | Critical | 2019-02-03 | – | 1,033 |
| Request smuggling on admin-official.line.me could lead to account takeoverAnalysed#740037 | Valid | LY Corporation | Injection and Smuggling | High | 2020-05-19 | – | 565 |
| XSS in steam react chat clientAnalysed#409850 | Valid | Valve | Cross-site Scripting | Critical | 2019-01-07 | $7,500 | 499 |
| How the Bug stole hackingAnalysed#762510 | Valid | HackerOne | Insecure Direct Object Reference | None | 2019-12-20 | – | 471 |
| SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127 | Valid | Valve | SQL Injection | Critical | 2018-07-27 | $25,000 | 410 |
| Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgAnalysed#340431 | Valid | Uber | Cryptography | High | 2020-04-30 | $4,000 | 376 |
| Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500 | Valid | TikTok | Access Control | Critical | 2021-03-17 | – | 371 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | TikTok | Cross-Site Request Forgery | High | 2020-12-15 | – | 366 |
| CRLF Injection in urllibAnalysed#590020 | Valid | Internet Bug Bounty | Injection and Smuggling | Medium | 2020-05-06 | $1,000 | 341 |
| [www.zomato.com] SQLi - /php/██████████ - item_idAnalysed#403616 | Valid | Eternal | SQL Injection | Critical | 2018-09-11 | $4,500 | 326 |
| SQL Injection on cookie parameterAnalysed#761304 | Valid | MTN Group | SQL Injection | High | 2020-05-03 | – | 323 |
| TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesAnalysed#333419 | Valid | Slack | Server-Side Request Forgery | Critical | 2020-03-12 | $3,500 | 323 |
| Reflected XSSAnalysed#739601 | Valid | Bumble | Cross-site Scripting | Critical | 2019-11-21 | $1,000 | 317 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Valid | TikTok | Command and Code Injection | Critical | 2021-04-15 | – | 312 |
| CSRF on connecting Paypal as Payment ProviderAnalysed#807924 | Valid | Shopify | Cross-Site Request Forgery | Medium | 2020-04-10 | – | 304 |
| HTTP Request Smuggling via HTTP/2Analysed#1211724 | Valid | Basecamp | Injection and Smuggling | Critical | 2021-08-27 | $7,500 | 300 |
| SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Analysed#549882 | Valid | Vimeo | Server-Side Request Forgery | Critical | 2019-12-13 | – | 276 |
| Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointAnalysed#2487889 | Valid | HackerOne | Insecure Direct Object Reference | Critical | 2024-05-23 | – | 266 |
| SSRF in graphQL query (pwapi.ex2b.com)Analysed#1864188 | Valid | EXNESS | Server-Side Request Forgery | Medium | 2023-07-24 | $3,000 | 261 |
| Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgAnalysed#1027822 | Valid | Starbucks | Access Control | Critical | 2020-12-09 | – | 247 |
| SQL Injection in agent-managerAnalysed#962889 | Valid | Acronis | SQL Injection | High | 2021-08-16 | – | 237 |
| An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashierAnalysed#1966006 | Valid | Unikrn | Insecure Direct Object Reference | High | 2023-07-17 | – | 232 |
| Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546 | Valid | TikTok | Authentication | Critical | 2022-02-23 | $15,000 | 219 |
| Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/Analysed#1685970 | Valid | Stripe | Authentication | High | 2022-10-19 | – | 212 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Valid | TikTok | Cross-site Scripting | Medium | 2022-08-19 | – | 201 |
| Stealing Facebook OAuth Code Through Screenshot viewerAnalysed#488269 | Valid | Rockstar Games | Information Disclosure | Medium | 2019-03-05 | – | 200 |
| Blocked user can see live videoAnalysed#1067967 | Valid | TikTok | Information Disclosure | Medium | 2021-05-28 | $418 | 198 |
| sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryAnalysed#769016 | Valid | Starbucks | Information Disclosure | Critical | 2020-02-26 | – | 197 |
| TikTok 2FA BypassAnalysed#1247108 | Valid | TikTok | Access Control | Medium | 2023-02-03 | $1,564 | 194 |
| Markdown parsing issue enables insertion of malicious tags and event handlersAnalysed#299728 | Valid | HackerOne | Cross-site Scripting | High | 2018-01-29 | $5,000 | 184 |
| Stored XSS & SSRF in Lark DocsAnalysed#892049 | Valid | Lark Technologies | Server-Side Request Forgery | Critical | 2021-02-05 | $3,000 | 178 |
| IDOR in the https://market.semrush.com/Analysed#837400 | Valid | Semrush | Access Control | Critical | 2020-04-30 | – | 173 |
| Unauthorized Access to TikTok Account [Private Videos] via API EndpointAnalysed#2868084 | Valid | TikTok | Insecure Direct Object Reference | Medium | 2025-01-24 | – | 167 |
| Server Side Request ForgeryAnalysed#644238 | Valid | Lark Technologies | Server-Side Request Forgery | Critical | 2021-03-29 | – | 164 |
| Information disclosure via a misconfigured third-party productAnalysed#739251 | Valid | Algolia | Information Disclosure | High | 2021-03-03 | – | 156 |
| Can delete other user's post and company page postAnalysed#337755 | Valid | Access Control | – | 2023-04-11 | – | 156 | |
| Frans Visits Vegas AnnouncementAnalysed#251747 | Valid | Frans Visits Vegas | No weakness recorded | – | 2017-07-20 | – | 154 |
| Email change or personal data change on the account.Analysed#1250037 | Valid | Stripe | Insecure Direct Object Reference | Critical | 2022-01-21 | $3,000 | 149 |
| Account takeover - improper validation of jwt signature (with regards to experiation date claim)Analysed#1760403 | Valid | Linktree | Access Control | High | 2022-12-26 | – | 147 |
| Sale cancellations from other sellers without restrictionsAnalysed#2495989 | Valid | MercadoLibre | Insecure Direct Object Reference | Critical | 2025-03-06 | – | 144 |
| Bug in GraphQL and API integration leads to limited user address disclosureAnalysed#473742 | Valid | Starbucks | Access Control | High | 2019-03-08 | – | 144 |
| Use-after-free in setsockopt IPV6_2292PKTOPTIONS (CVE-2020-7457)Analysed#1441103 | Valid | PlayStation | Memory Corruption | High | 2022-09-20 | $10,000 | 143 |
| Reading Emails in Uber SubdomainsAnalysed#156536 | Valid | Uber | Authentication | – | 2016-09-14 | – | 141 |
| [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Analysed#3459285 | Valid | Stripo Inc | Access Control | Critical | 2026-01-20 | – | 140 |
| Bypassing HackerOne 2FA due to race conditionAnalysed#2598548 | Valid | HackerOne | Input Validation and Logic | Medium | 2024-10-30 | – | 139 |
| Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonAnalysed#952501 | Valid | Eternal | SQL Injection | Critical | 2020-08-10 | $2,000 | 137 |
| [api.zomato.com] Able to manipulate order amountAnalysed#512968 | Valid | Eternal | Input Validation and Logic | High | 2019-04-16 | – | 136 |
| SSRF on music.line.me through getXML.phpAnalysed#746024 | Valid | LY Corporation | Server-Side Request Forgery | High | 2020-03-25 | $4,500 | 135 |
| Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageAnalysed#748903 | Valid | Semrush | Misconfiguration and Insecure Design | Medium | 2020-01-10 | – | 133 |
| IDOR on ads.tiktok.com Allows Unauthorized Product AdditionAnalysed#2848610 | Valid | TikTok | Insecure Direct Object Reference | Low | 2025-02-20 | $500 | 131 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.