Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0Analysed#3395221	Valid	SQL Injection	High	2025-10-24	–	93
IDOR Vulnerability in Banner DeletionAnalysed#3401612	Valid	Insecure Direct Object Reference	High	2025-11-19	–	56
Blind SQL injection via clientid parameter in zone‑include.phpAnalysed#3653196	Valid	SQL Injection	High	2026-06-03	–	49
Broken Access Control allows advertiser accounts to delete trackers they do not ownAnalysed#3445710	Valid	Access Control	High	2026-01-14	–	47
Missing access control when linking banners or campaigns to zonesAnalysed#3650504	Valid	Access Control	Medium	2026-06-03	–	42
PHP code injection via delivery limitation logicalAnalysed#3656781	Valid	Command and Code Injection	High	2026-06-03	–	36
Missing access control when linking trackers to campaignsAnalysed#3650582	Valid	Access Control	Medium	2026-06-03	–	35
Authorization bypass allows changing email address of other usersAnalysed#3398283	Valid	Access Control	High	2025-11-19	–	35
Stored-XSS in campaign name displayed in Banners modalAnalysed#3411750	Valid	Cross-site Scripting	Medium	2025-11-19	–	32
Reflected XSS via unsanitised refresh parameter in zone invocation tagAnalysed#3780806	Valid	Cross-site Scripting	Medium	2026-06-25	–	29
Stored XSS in Conversion Statistics via Tracker NameAnalysed#3400506	Valid	Cross-site Scripting	High	2025-11-19	–	28
Reflected XSS via clientid parameter in zone‑include.phpAnalysed#3653316	Valid	Cross-site Scripting	Medium	2026-06-03	–	26

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.