Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Blind XSS via Feedback form.Analysed#1339034 | Valid | Cross-site Scripting | High | 2022-05-03 | – | 57 |
| Email templates XSS by filterXSS bypassAnalysed#1404804 | Valid | Cross-site Scripting | High | 2022-05-25 | $1,250 | 51 |
| IDOR: leak buyer info & Publish/Hide foreign commentsAnalysed#1410498 | Valid | Insecure Direct Object Reference | High | 2022-03-31 | $1,250 | 47 |
| Stored XSS in "product type" field executed via product filtersAnalysed#1404770 | Valid | No weakness recorded | Medium | 2022-04-26 | $500 | 30 |
| Race condition on https://judge.me/peopleAnalysed#1566017 | Valid | Race Conditions | Low | 2022-08-01 | $250 | 26 |
| Stored XSS in Public Profile ReviewsAnalysed#1398285 | Valid | Cross-site Scripting | None | 2023-02-01 | $250 | 25 |
| Improper Access Control in Ali Express ImporterAnalysed#1609955 | Valid | Access Control | Medium | 2023-02-01 | – | 21 |
| XSS in Widget Review Form Preview in settingsAnalysed#1595905 | Valid | Cross-site Scripting | Medium | 2022-09-29 | – | 16 |
| stored XSS on AliExpress Review Importer/Products when delete productAnalysed#1425882 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 15 |
| Self-XSS due to image URL can be eploited via XSSJacking techniques in review emailAnalysed#1397940 | Valid | No weakness recorded | Medium | 2023-02-01 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.