Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Analysed#502758 | Valid | Starbucks | Command and Code Injection | Critical | 2019-04-10 | – | 572 |
| Request smuggling on admin-official.line.me could lead to account takeoverAnalysed#740037 | Valid | LY Corporation | Injection and Smuggling | High | 2020-05-19 | – | 565 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Valid | Snapchat | Access Control | Critical | 2021-07-29 | – | 562 |
| Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationAnalysed#910300 | Valid | Shopify | Access Control | Critical | 2020-09-15 | – | 559 |
| Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com#771666 | Valid | Eternal | Injection and Smuggling | Critical | 2020-07-09 | – | 559 |
| Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928 | Valid | Ubiquiti Inc. | Command and Code Injection | Critical | 2019-11-08 | – | 553 |
| [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureAnalysed#401793 | Valid | Grab | Cross-site Scripting | High | 2019-03-15 | – | 552 |
| BAD Code !#180074 | N/A | Paragon Initiative Enterprises | Command and Code Injection | None | 2016-11-04 | – | 549 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | GitLab | Command and Code Injection | Critical | 2019-07-17 | $12,000 | 542 |
| Server Side Request Forgery (SSRF) via Analytics ReportsAnalysed#2262382 | Valid | HackerOne | Server-Side Request Forgery | Critical | 2023-12-08 | $25,000 | 529 |
| SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLog#811111 | No longer public | Razer | SQL Injection | – | – | $2,000 | 528 |
| Shopify Stocky App OAuth MisconfigurationAnalysed#740989 | Valid | Shopify | Access Control | Medium | 2019-12-11 | – | 527 |
| One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186 | Valid | Access Control | Critical | 2022-08-02 | – | 509 | |
| Remote Code Execution in Slack desktop apps + bonusAnalysed#783877 | Valid | Slack | Command and Code Injection | Critical | 2020-08-28 | – | 509 |
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | GitLab | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| XSS in steam react chat clientAnalysed#409850 | Valid | Valve | Cross-site Scripting | Critical | 2019-01-07 | $7,500 | 499 |
| Able to Become Admin for Any LINE Official AccountAnalysed#698579 | Valid | LY Corporation | Access Control | Critical | 2020-03-25 | – | 493 |
| Password theft login.newrelic.com via Request Smuggling#498052 | No longer public | New Relic | Injection and Smuggling | – | – | $3,000 | 490 |
| Reflected XSS in OAUTH2 login flowAnalysed#697099 | Valid | LY Corporation | Cross-site Scripting | Medium | 2020-04-21 | $1,990 | 489 |
| SQL injection on contactws.contact-sys.com in TScenObject action ScenObjects leads to remote code execution#816254 | No longer public | QIWI | Command and Code Injection | – | 2020-06-19 | – | 475 |
| profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434 | Valid | HackerOne | Denial of Service | Medium | 2020-03-25 | – | 475 |
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082 | Valid | TikTok | Cross-site Scripting | High | 2020-11-19 | – | 473 |
| How the Bug stole hackingAnalysed#762510 | Valid | HackerOne | Insecure Direct Object Reference | None | 2019-12-20 | – | 471 |
| Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`Analysed#684092 | Valid | BlockDev Sp. Z o.o | Input Validation and Logic | Critical | 2019-10-01 | – | 466 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Valid | Snapchat | Information Disclosure | High | 2020-11-04 | $10,000 | 464 |
| [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813 | Valid | Uber | Information Disclosure | Critical | 2021-02-25 | $40,000 | 458 |
| Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsAnalysed#689314 | Valid | GitLab | Access Control | Critical | 2019-11-27 | $12,000 | 457 |
| XSS vulnerable parameter in a location hashAnalysed#146336 | Valid | Slack | Cross-site Scripting | – | 2019-10-16 | – | 455 |
| Blind XSS on image uploadAnalysed#1010466 | Valid | CS Money | Cross-site Scripting | Critical | 2020-12-26 | $1,000 | 450 |
| Modify in-flight data to payment provider Smart2PayAnalysed#1295844 | Valid | Valve | Input Validation and Logic | Critical | 2021-08-10 | $7,500 | 443 |
| Reset password link sent over unsecured http protocolAnalysed#1888915 | Valid | Mattermost | Access Control | High | 2023-05-10 | $750 | 440 |
| Flickr Account Takeover using AWS Cognito APIAnalysed#1342088 | Valid | Flickr | Authentication | Critical | 2021-12-18 | – | 440 |
| CRLF injectionAnalysed#446271 | Valid | X / xAI | No weakness recorded | Medium | 2019-12-25 | – | 439 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Snapchat | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| Blind SQL Injection#758654 | No longer public | InnoGames | SQL Injection | – | – | $2,000 | 432 |
| An attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameAnalysed#2032716 | Valid | HackerOne | Information Disclosure | High | 2023-07-04 | $12,500 | 429 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | GitLab | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781 | Valid | Uber | Authentication | High | 2019-01-25 | – | 427 |
| June 2022 Incident ReportAnalysed#1622449 | Valid | HackerOne | No weakness recorded | Critical | 2022-07-01 | – | 426 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Valid | Snapchat | Server-Side Request Forgery | – | 2020-11-30 | – | 421 |
| Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956 | Valid | Valve | Command and Code Injection | Critical | 2019-10-08 | – | 420 |
| Remote code execution on Basecamp.comAnalysed#365271 | Valid | Basecamp | Command and Code Injection | Critical | 2020-11-26 | $5,000 | 417 |
| Full account takeoverAnalysed#314808 | Valid | Reverb.com | Access Control | High | 2020-03-19 | – | 412 |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447 | Valid | GitLab | Information Disclosure | Critical | 2020-06-08 | $10,000 | 410 |
| SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127 | Valid | Valve | SQL Injection | Critical | 2018-07-27 | $25,000 | 410 |
| touch.mail.ru / e.mail.ru memory content disclosure#513236 | No longer public | Mail.ru | No weakness recorded | – | 2019-10-30 | $10,000 | 409 |
| H1514 Server Side Template Injection in Return Magic email templates?Analysed#423541 | Valid | Shopify | Command and Code Injection | – | 2019-04-04 | – | 409 |
| Employee's GitHub Token Found In Travis CI Build LogsAnalysed#496937 | Valid | Superhuman (formerly Grammarly) | Information Disclosure | High | 2019-05-22 | $5,000 | 408 |
| Denial of service to WP-JSON API by cache poisoning the CORS allow origin headerAnalysed#591302 | Valid | Automattic | Denial of Service | Medium | 2020-04-16 | – | 405 |
| Unrestricted file upload on [ambassador.mail.ru]#854032 | No longer public | Mail.ru | Command and Code Injection | – | 2020-05-08 | $3,000 | 404 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.