Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279	Valid	File and Path Handling	High	2026-06-14	$5,000	176
RCE of Burp Scanner / Crawler via ClickjackingAnalysed#1274695	Valid	Command and Code Injection	High	2023-10-10	$3,000	172
DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolAnalysed#3176157	Valid	Server-Side Request Forgery	None	2025-10-08	–	144
HTML Injection in Swing can disclose netNTLM hash or cause DoSAnalysed#1054382	Valid	Information Disclosure	Medium	2021-03-29	$1,000	117
CSP bypass on PortSwigger.net using Google script resourcesAnalysed#2279346	Valid	Cross-site Scripting	Medium	2024-02-18	–	113
Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authenticationAnalysed#3972558	Valid	No weakness recorded	Medium	2026-10-15	$1,000	58
A user with only [MODIFY_SETTINGS] permmision could takeover any user accountsAnalysed#2279010	Valid	Access Control	Low	2024-05-20	–	51
RCE in 'Copy as Node Request' BApp via code injectionAnalysed#1167530	Valid	Command and Code Injection	None	2021-04-22	–	51
burp does not validate the common name of the presented collaborator server certificateAnalysed#337680	Valid	Cryptography	Medium	2018-06-13	$1,500	39
Redirection in Repeater & Intruder TabAnalysed#1541301	Valid	Open Redirect	Low	2022-08-11	$150	36
UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding AuthenAnalysed#3717354	Valid	Other weaknesses	None	2026-06-15	–	28
The role "CI-driven scan initiator" provides excessive read accessAnalysed#2276148	Valid	Access Control	Low	2026-01-02	–	28
Leak of Platform Authentication credentials via RepeaterAnalysed#302651	Valid	Information Disclosure	Low	2018-06-13	$200	15

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.