Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Session ID reuse allowing XML‑RPC API authentication bypass#3672641	Valid	Authentication	Medium	2026-06-03	–	8
Missing access control when modifying parent entities via XML‑RPC#3677576	Valid	Access Control	Medium	2026-06-03	–	7
Reflected XSS on /admin/campaign-zone-zones.php#1097979	Valid	Cross-site Scripting	Medium	2021-03-16	–	7
Open redirection bypass in /www/admin/campaign-modify.php#794144	Valid	Open Redirect	Low	2020-03-12	–	7
Reflected XSS on Zones > Invocation Code#178611	Valid	Cross-site Scripting	Low	2017-08-02	–	7
Reflected XSS in Step 2 of the Installation#170156	Valid	Cross-site Scripting	–	2017-08-02	–	6
Banner status override by advertiser‑level users#3678828	Valid	Access Control	Medium	2026-06-03	–	5
Cross Site Scripting and Open Redirect in affiliate-preview.php file#819362	Valid	Open Redirect	Low	2021-01-20	–	4
Deserialization of Untrusted Data in www/delivery/adxmlrpc.php#512076	Valid	Deserialization and Object Injection	Critical	2019-04-23	–	4
Open redirect in switch account functionality#390663	Valid	Open Redirect	Low	2019-04-23	–	3
Open redirect in ck.php and lg.php#1081406	Valid	Open Redirect	Medium	2021-01-20	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.