Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored Xss Vulnerability on ████████Analysed#380103 | Valid | Cross-site Scripting | High | 2020-05-14 | – | 192 |
| Bypassing CORS Misconfiguration Leads to Sensitive ExposureAnalysed#768151 | Valid | Input Validation and Logic | Medium | 2020-05-14 | – | 145 |
| Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.milAnalysed#2950536 | Valid | Access Control | Critical | 2025-02-12 | – | 142 |
| Public instance of Jenkins on https://██████████/ with /script enabledAnalysed#768266 | Valid | Command and Code Injection | Critical | 2020-01-31 | – | 118 |
| Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/Analysed#2083771 | Valid | Command and Code Injection | Critical | 2024-12-18 | – | 114 |
| [hta3] Remote Code Execution on ████Analysed#1072832 | Valid | Command and Code Injection | Critical | 2023-05-15 | – | 104 |
| Wordpress Takeover using setup configuration at http://████.edu [HtUS]Analysed#1626205 | Valid | Misconfiguration and Insecure Design | Critical | 2023-01-13 | $1,000 | 102 |
| Public google drive link Exposes Military Orders Containing PII (Name, SSN etc..) and Operational DetailsAnalysed#2926447 | Valid | Information Disclosure | Critical | 2025-01-24 | – | 99 |
| Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeoverAnalysed#2748003 | Valid | Information Disclosure | Critical | 2024-10-25 | – | 98 |
| [███████] Information disclosure due unauthenticated access to APIs and system browser functionsAnalysed#2122964 | Valid | Information Disclosure | Medium | 2023-11-03 | – | 97 |
| XXE in DoD website that may lead to RCEAnalysed#227880 | Valid | Injection and Smuggling | Critical | 2019-10-04 | – | 97 |
| Time based SQL injection at████████Analysed#2312334 | Valid | SQL Injection | High | 2024-01-26 | – | 96 |
| LOGJ4 VUlnerability [HtUS]Analysed#1624137 | Valid | Command and Code Injection | Critical | 2022-11-18 | $1,000 | 94 |
| Remote Code Execution in ██████Analysed#710864 | Valid | Command and Code Injection | Critical | 2020-05-11 | – | 94 |
| SQL InjectionAnalysed#2737595 | Valid | SQL Injection | High | 2024-10-25 | – | 91 |
| ███ leaking PII of tour visitors (names, email addresses, phone numbers) via misconfigured record permissionsAnalysed#2294930 | Valid | Cryptography | Critical | 2024-03-22 | – | 90 |
| User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspxAnalysed#2190808 | Valid | Access Control | Critical | 2023-11-03 | – | 88 |
| CSRF leads to Account takeoverAnalysed#2699029 | Valid | Cross-Site Request Forgery | High | 2024-12-18 | – | 87 |
| [SQLI ]Time Bassed Injection at ██████████ via referer headerAnalysed#995122 | Valid | SQL Injection | High | 2020-10-16 | – | 87 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#248116 | Valid | Command and Code Injection | Critical | 2019-10-04 | – | 84 |
| Publicly Editable U.S. Air Force Google Spreadsheet Exposing Student Leave DataAnalysed#2682079 | Valid | Access Control | Medium | 2025-02-12 | – | 83 |
| Blind Sql Injection in https://████Analysed#2597543 | Valid | SQL Injection | Medium | 2024-08-29 | – | 81 |
| SQL Injection on www.██████████ on countID parameterAnalysed#390879 | Valid | SQL Injection | High | 2019-10-08 | – | 80 |
| Improper Authentication Allows Making Appeals as Other UsersAnalysed#2666323 | Valid | Authentication | Medium | 2025-02-12 | – | 77 |
| IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS]Analysed#1626508 | Valid | Insecure Direct Object Reference | High | 2024-06-27 | $500 | 77 |
| SQL Injection in ████Analysed#419017 | Valid | SQL Injection | High | 2019-08-19 | – | 73 |
| Full account takeover of any user through reset passwordAnalysed#2194928 | Valid | Authentication | Medium | 2023-11-17 | – | 71 |
| CVE-2020-3187 - Unauthenticated Arbitrary File DeletionAnalysed#960330 | Valid | File and Path Handling | Critical | 2020-09-21 | – | 70 |
| Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`Analysed#2778380 | Valid | File and Path Handling | High | 2024-10-25 | – | 69 |
| Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)Analysed#1556950 | Valid | Misconfiguration and Insecure Design | Critical | 2025-01-24 | – | 69 |
| RCE on █████ via CVE-2017-10271Analysed#576887 | Valid | Command and Code Injection | Critical | 2019-07-01 | – | 68 |
| CSRF leads to Account takeoverAnalysed#2712857 | Valid | Cross-Site Request Forgery | High | 2024-12-18 | – | 67 |
| Boolen Based Blind Sql Injection Via User Agent in ███.milAnalysed#2599826 | Valid | SQL Injection | Medium | 2025-01-24 | – | 67 |
| Improper Authentication (Login without Registration with any user) at ████Analysed#2334420 | Valid | Authentication | High | 2024-03-22 | – | 67 |
| [█████████] Administrative access to Oracle WebLogic Server using default credentialsAnalysed#804548 | Valid | Access Control | Critical | 2020-06-25 | – | 65 |
| IDOR leads to PII LeakAnalysed#2586584 | Valid | Insecure Direct Object Reference | Medium | 2024-07-19 | – | 64 |
| Subdomain takeover ████████.milAnalysed#2499178 | Valid | Access Control | Critical | 2024-06-27 | – | 64 |
| CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/Analysed#2742457 | Valid | Command and Code Injection | Critical | 2024-10-25 | – | 62 |
| Unauthenticated SQL Injection at █████████ [HtUS]Analysed#1626226 | Valid | SQL Injection | Critical | 2022-10-14 | – | 61 |
| Authentication Bypass on https://███████/Analysed#2414707 | Valid | Authentication | Medium | 2024-07-19 | – | 58 |
| CVE-2023-29489 XSS in cpanel at [www.███] - Securado, OmanAnalysed#1982630 | Valid | Cross-site Scripting | Medium | 2023-06-09 | – | 58 |
| LFI with potential to RCE on ██████ using CVE-2019-3396Analysed#538771 | Valid | File and Path Handling | High | 2019-10-04 | – | 58 |
| SSRF to read AWS metaData at https://█████/ [HtUS]Analysed#1624140 | Valid | Server-Side Request Forgery | Critical | 2022-10-14 | $1,000 | 57 |
| Remote Code Execution through DNN Cookie DeserializationAnalysed#876708 | Valid | Command and Code Injection | High | 2020-05-27 | – | 56 |
| Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce configAnalysed#2623715 | Valid | Access Control | High | 2024-12-18 | – | 55 |
| Reflected XSS via Keycloak on ███ [CVE-2021-20323]Analysed#2221104 | Valid | Cross-site Scripting | Medium | 2024-05-03 | – | 55 |
| Sensitive data exposure via /secure/███████ endpoint on ████████Analysed#1278952 | Valid | Information Disclosure | Medium | 2024-12-18 | – | 55 |
| Time-based blind SQL injectionAnalysed#2759243 | Valid | SQL Injection | Medium | 2025-01-24 | – | 53 |
| Subdomain takeover ██████Analysed#2552243 | Valid | Misconfiguration and Insecure Design | Critical | 2024-07-26 | – | 53 |
| Open Akamai ARL XSS on http://master-config-████████Analysed#1315907 | Valid | Cross-site Scripting | Medium | 2024-07-26 | – | 53 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.