Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Registration captcha bypass#223324 | Valid | Misconfiguration and Insecure Design | Medium | 2017-05-17 | – | 8 |
| Stored XSS @ /engage/<project_slug>#472391 | Valid | Cross-site Scripting | Medium | 2019-07-02 | – | 7 |
| Browser Self XSS Protection not implemented#400781 | Valid | Information Disclosure | – | 2018-09-26 | – | 7 |
| Password token validation in Weblate Bypass #2#244287 | Valid | No weakness recorded | – | 2017-08-21 | – | 7 |
| Running 2 accounts with a single email [Part 2]#241608 | Valid | Input Validation and Logic | – | 2017-10-07 | – | 7 |
| Weblate |Security Misconfiguration| Method Enumeration Possible on domain#230648 | Valid | No weakness recorded | None | 2017-07-02 | – | 7 |
| Takeover of an account via reset password options after removing the account#230076 | Valid | Authentication | Low | 2017-06-13 | – | 7 |
| Information Disclosure on demo.weblate.org#229620 | Valid | Information Disclosure | Low | 2017-06-02 | – | 7 |
| Captcha Bypass at Email Reset can lead to Spamming users.#229541 | Valid | Misconfiguration and Insecure Design | – | 2017-06-02 | – | 7 |
| Design Flaw in session management of password reset#229417 | Valid | Access Control | – | 2017-06-02 | – | 7 |
| CSRF to Connect third party Account#225100 | Valid | Cross-Site Request Forgery | Medium | 2017-05-02 | – | 7 |
| Running 2 accounts with a single email#224072 | Valid | Input Validation and Logic | None | 2017-05-18 | – | 7 |
| Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/#223454 | Valid | Memory Corruption | Low | 2017-05-18 | – | 7 |
| CSV Injection with the CSV export feature#223344 | Valid | Command and Code Injection | Low | 2017-05-17 | – | 7 |
| CSRF : Reset API#223333 | Valid | Cross-Site Request Forgery | Low | 2017-05-17 | – | 7 |
| Logout CSRF#223329 | Valid | Cross-Site Request Forgery | Low | 2017-05-17 | – | 7 |
| Secret_key in GitHub#926093 | Informative | Information Disclosure | None | 2020-07-18 | – | 6 |
| 2nd issue>>> flood of email no rate limit on delete account confirmation email >>#404713 | Valid | Misconfiguration and Insecure Design | Low | 2018-09-28 | – | 6 |
| Application allowing old password to be set as new password | hosted.weblate.org#264934 | Valid | No weakness recorded | – | 2017-10-05 | – | 6 |
| Improper validation of unicode characters #3#243635 | Valid | No weakness recorded | – | 2017-08-21 | – | 6 |
| Persistence of Third Party Association.#241623 | Valid | Input Validation and Logic | – | 2017-08-21 | – | 6 |
| Full Name Overwrite on Third party login#241598 | Valid | No weakness recorded | – | 2017-08-21 | – | 6 |
| Old password can be new password#229577 | Valid | No weakness recorded | Low | 2017-06-03 | – | 6 |
| CSV export filter bypass leads to formula injection.#223999 | Valid | Command and Code Injection | Medium | 2017-05-17 | – | 6 |
| No Rate Limitting at Change Password#223694 | Valid | No weakness recorded | Medium | 2017-05-17 | – | 6 |
| [hosted.weblate.org]Account Takeover#223637 | Valid | No weakness recorded | Low | 2017-05-17 | – | 6 |
| Open SMTP port can let anyone send email from mail.chihar.com#223435 | N/A | Cryptography | – | 2017-05-20 | – | 6 |
| Login using disconnected google account i.e login using old email id#223427 | Valid | Authentication | Low | 2017-05-17 | – | 6 |
| You can simply just use passwords that simply are as 123456#223374 | Valid | No weakness recorded | Low | 2017-05-19 | – | 6 |
| Send Empty CSRF leads to log out user on [https://hosted.weblate.org/accounts/profile]#1003468 | Valid | Cross-Site Request Forgery | Low | 2020-10-12 | – | 5 |
| No Rate Limit On Add new word#479021 | Valid | Input Validation and Logic | Low | 2019-01-14 | – | 5 |
| Tab nabbing via window.opener#403891 | Valid | No weakness recorded | – | 2018-09-01 | – | 5 |
| Add another email address without verification#265987 | Valid | Access Control | – | 2017-10-05 | – | 5 |
| Password token validation in Weblate Bypass#243842 | Valid | Authentication | None | 2017-08-21 | – | 5 |
| No Rate Limitation on Regenerate Api Key#243619 | Valid | No weakness recorded | – | 2017-08-21 | – | 5 |
| Improper validation of unicode characters still not fixed #2#243611 | Valid | No weakness recorded | – | 2017-08-21 | – | 5 |
| The username of an account can be ..#243609 | Valid | Input Validation and Logic | None | 2017-07-27 | – | 5 |
| Improper validation of unicode characters#242171 | Valid | Misconfiguration and Insecure Design | – | 2017-08-19 | – | 5 |
| Improper validation of unicode characters still not fixed#241596 | Valid | No weakness recorded | – | 2017-08-21 | – | 5 |
| Open redirect while disconnecting Email#238117 | Valid | Open Redirect | – | 2017-06-08 | – | 5 |
| Improper Cookie expiration | Cookies Expiration Set to Future#232306 | Valid | No weakness recorded | Low | 2017-08-31 | – | 5 |
| Option method enabled#230194 | Valid | Misconfiguration and Insecure Design | None | 2017-05-21 | – | 5 |
| Missing restriction on string size#229796 | Valid | No weakness recorded | Low | 2017-06-03 | – | 5 |
| Self-XSS can be achieved in the editor link using filter bypass#229735 | Valid | Cross-site Scripting | None | 2017-06-02 | – | 5 |
| Csrf in watch-unwatch projects#229405 | Valid | Cross-Site Request Forgery | Low | 2017-08-17 | – | 5 |
| session id missing secure flag - Hosted Website#224379 | Valid | No weakness recorded | Low | 2017-05-17 | – | 5 |
| Open redirect while disconnecting authenticated account#224317 | Valid | Open Redirect | Medium | 2017-06-08 | – | 5 |
| Access to completion page without performing any action#223846 | Valid | Access Control | None | 2017-05-18 | – | 5 |
| Spamming any user from Reset Password Function#223525 | Valid | Misconfiguration and Insecure Design | Low | 2017-05-17 | – | 5 |
| Open port leads to information disclosure#223421 | Informative | Information Disclosure | Low | 2018-09-10 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.