Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting48
- Cross-Site Request Forgery4
- Open Redirect1
- Server-Side Request Forgery4
- SQL Injection3
- Command and Code Injection3
- Deserialization and Object Injection2
- File and Path Handling1
- Misconfiguration and Insecure Design5
- Cryptography2
- Information Disclosure5
- Authentication2
- Access Control2
- Insecure Direct Object Reference1
- No weakness recorded4
Access (title)Any
87 of 15,219 reports · 227 analysed so far
- #768322ValidRemote Code Execution (Reverse Shell) - File ManagerConcrete CMS · Command and Code Injection · 2020–114votes
- #226659ValidPassword Reset link hijacking via Host Header PoisoningConcrete CMS · Access Control · 2017–73votes
- #876800ValidTime-base SQL Injection in Search UsersConcrete CMS · SQL Injection · 2020–60votes
- #921288ValidArbitrary File delete via PHAR deserializationConcrete CMS · Deserialization and Object Injection · 2021–28votes
- #437863ValidSVG file that HTML Included is able to upload via File ManagerConcrete CMS · Cross-site Scripting · 2019–26votes
- #265284Valid'cnvID' parameter vulnerable to Insecure Direct Object ReferencesConcrete CMS · Insecure Direct Object Reference · 2018–22votes
- #753567ValidXSS in select attribute optionsConcrete CMS · Cross-site Scripting · 2020–20votes
- #243865ValidSSRF thru File ReplaceConcrete CMS · Server-Side Request Forgery · 2018–19votes
- #1102067ValidAuthenticated path traversal to RCEConcrete CMS · File and Path Handling · 2021–18votes
- #289330ValidReflected XSS vulnerability in Database name field on installation screenConcrete CMS · Cross-site Scripting · 2018–18votes
- #841947ValidRemote Code Execution through Extension Bypass on Log FunctionalityConcrete CMS · Command and Code Injection · 2020–16votes
- #863221ValidSSRF bypassConcrete CMS · Server-Side Request Forgery · 2021–15votes
- #768313ValidCross Site Scripting (XSS) Stored - Private messagingConcrete CMS · Cross-site Scripting · 2020–15votes
- #147570ValidLocal File Inclusion path bypassConcrete CMS · Misconfiguration and Insecure Design · 2016–13votes
- #643442ValidUnauthenticated reflected XSS in preview_as_user functionConcrete CMS · Cross-site Scripting · 2019 · no account (title)–12votes
- #230278ValidStored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ]Concrete CMS · Cross-site Scripting · 2017–12votes
- #152052ValidCSRF Full Account TakeoverConcrete CMS · Cross-Site Request Forgery · 2016–11votes
- #59665ValidLocal File Inclusion Vulnerability in Concrete5 version 5.7.3.1Concrete CMS · Misconfiguration and Insecure Design · 2016–11votes
- #4795ValidBypass auth.email-domainsConcrete CMS · Authentication · 2014–11votes
- #1369312ValidSSRF mitigation bypass using DNS Rebind attackConcrete CMS · Server-Side Request Forgery · 2022–10votes
- #1350444ValidA bypass of adding remote files in concrete5 FIlemanager leads to remote code executionConcrete CMS · No weakness recorded · 2021–10votes
- #1102018ValidStored unauth XSS in calendar event via CSRFConcrete CMS · Cross-site Scripting · 2021 · no account (title)–10votes
- #4792ValidHttpOnly flag not set for cookie on concrete5.orgConcrete CMS · Misconfiguration and Insecure Design · 2014–10votes
- #248133ValidStored XSS vulnerability in RSS Feeds Description fieldConcrete CMS · Cross-site Scripting · 2017–9votes
- #230029ValidStored XSS in Pages SEO dialog Name field (concrete5 8.1.0)Concrete CMS · Cross-site Scripting · 2017–9votes
- #873584ValidStored XSS in the file search filterConcrete CMS · Cross-site Scripting · 2020–8votes
- #247517ValidStored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payloadConcrete CMS · Cross-site Scripting · 2017–8votes
- #1364797ValidSSRF - pivoting in the private LANConcrete CMS · Server-Side Request Forgery · 2022–7votes
- #300571ValidStored XSS on Add CalendarConcrete CMS · Cross-site Scripting · 2018–7votes
- #300532ValidStored XSS on Add Event in CalendarConcrete CMS · Cross-site Scripting · 2018–7votes
- #251358ValidStored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap]Concrete CMS · Cross-site Scripting · 2017–7votes
- #247521ValidStored XSS in Name field in User Groups/Group Details formConcrete CMS · Cross-site Scripting · 2017–7votes
- #221325ValidStored XSS in Express Objects - Concrete5 v8.1.0Concrete CMS · No weakness recorded · 2017–7votes
- #4826ValidXSS in private messageConcrete CMS · Cross-site Scripting · 2014–7votes
- #982130ValidFetching the update json scheme from concrete5 over HTTP leads to remote code executionConcrete CMS · Cryptography · 2021–6votes
- #768327ValidUnauthenticated HTML Injection Stored - ContactUs formConcrete CMS · No weakness recorded · 2020 · no account (title)–6votes
- #23921Validbroken authenticationConcrete CMS · Authentication · 2014–6votes
- #7736ValidFULL PATH DISCLOSURConcrete CMS · Information Disclosure · 2014–6votes
- #6853ValidXSS on [/concrete/concrete/elements/dashboard/sitemap.php]Concrete CMS · Cross-site Scripting · 2014–6votes
- #4839ValidXSS IN member List (Because of City Textbox)Concrete CMS · Cross-site Scripting · 2014–6votes
- #1063039ValidPhar Deserialization Vulnerability via Logging SettingsConcrete CMS · Deserialization and Object Injection · 2021–5votes
- #873474ValidStored XSS on express entriesConcrete CMS · Cross-site Scripting · 2020–5votes
- #616770ValidStored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text"Concrete CMS · Cross-site Scripting · 2021–5votes
- #1397804Informativeopen redirect to a remote website which can phish usersConcrete CMS · Open Redirect · 2022–4votes
- #221380ValidStored XSS in RSS Feeds Title (Concrete5 v8.1.0)Concrete CMS · Cross-site Scripting · 2017–4votes
- #4938Validpage_controls_menu_js can reveal collection version of pageConcrete CMS · Information Disclosure · 2014–4votes
- #4808Valid/index.php/dashboard/sitemap/explore/ Cross-site scriptingConcrete CMS · Cross-site Scripting · 2014–4votes
- #59666InformativeUnsafe usage of Host HTTP header in Concrete5 version 5.7.3.1Concrete CMS · Misconfiguration and Insecure Design · 2018–3votes
- #59663ValidSendmail Remote Code Execution Vulnerability in Concrete5 version 5.7.3.1Concrete CMS · Command and Code Injection · 2015–3votes
- #59662ValidMultiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1Concrete CMS · Cross-site Scripting · 2016–3votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.