Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [careers.informatica.com] Reflected Cross Site Scripting to XSS Shell PossibleAnalysed#147196 | Valid | Command and Code Injection | High | 2016-12-31 | – | 50 |
| [rev-app.informatica.com] - XXEAnalysed#105434 | Valid | Denial of Service | High | 2016-08-02 | – | 45 |
| Cross-site Scripting (XSS) - DOM - iqcard.informatica.comAnalysed#1004833 | Valid | Cross-site Scripting | High | 2020-10-13 | – | 27 |
| [app.informaticaondemand.com] XXEAnalysed#105753 | Valid | Denial of Service | High | 2017-04-08 | – | 25 |
| XXE in upload file featureAnalysed#105787 | Valid | Denial of Service | High | 2017-05-10 | – | 22 |
| [doc.rt.informaticacloud.com] Arbitrary File Reading via Double URL Encode#232371 | Valid | File and Path Handling | High | 2022-07-23 | – | 20 |
| Store XSS on Informatica University via transcript (informatica.csod.com)#219509 | Valid | Cross-site Scripting | High | 2017-09-09 | – | 17 |
| Improper Sanitization leads to XSS Fire on admin panel#1011888 | Valid | Cross-site Scripting | High | 2021-08-03 | – | 15 |
| [marketplace.informatica.com] - XXE#106797 | Valid | Command and Code Injection | High | 2016-12-09 | – | 14 |
| Cross site scripting#1095797 | Valid | Cross-site Scripting | High | 2021-05-17 | – | 12 |
| [rev-app.informatica.com] - XXE via SAML#106865 | Valid | Command and Code Injection | High | 2016-12-09 | – | 12 |
| [informatica.com]- Cross Site scripting#204237 | Valid | Cross-site Scripting | High | 2017-10-30 | – | 10 |
| [ipm.informatica.com]- Broken Authentication#201152 | Valid | Authentication | High | 2017-04-11 | – | 10 |
| [kb.informatica.com] DOM based XSS in the bindBreadCrumb function#189834 | Valid | Cross-site Scripting | High | 2017-06-24 | – | 10 |
| [uk.informatica.com] XSS on uk.informatica..com#143323 | Valid | Cross-site Scripting | High | 2017-02-28 | – | 10 |
| [careers.informatica.com] Cross Site Script Vulnerability on informatica#42537 | Valid | Cross-site Scripting | High | 2017-05-10 | – | 10 |
| Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com]#203912 | Valid | Cross-site Scripting | High | 2017-04-08 | – | 9 |
| [marketplace.informatica.com] Persistent XSS through document title#181816 | Valid | Cross-site Scripting | High | 2017-02-02 | – | 8 |
| [network.informatica.com] The login form XSS via the referer value#190016 | Valid | Cross-site Scripting | High | 2017-05-22 | – | 7 |
| [kb.informatica.com] Stored XSS#170369 | Valid | Cross-site Scripting | High | 2017-04-09 | – | 7 |
| XXE at Informatica sub-domain#150520 | Valid | Command and Code Injection | High | 2018-04-30 | – | 7 |
| [marketplace.informatica.com] - Stored XSS#277259 | Valid | Cross-site Scripting | High | 2017-12-15 | – | 6 |
| [doc.rt.informaticacloud.com] Reflected XSS via Stack Strace#232320 | Valid | Cross-site Scripting | High | 2022-07-23 | – | 6 |
| [now.informatica.com] Reflective Xss#81191 | Valid | Cross-site Scripting | High | 2016-05-19 | – | 6 |
| [marketplace.informatica.com]- Stored XSS on Image title and Edit Property#202951 | Valid | Cross-site Scripting | High | 2017-04-21 | – | 5 |
| [marketplace.informatica.com] Search XSS#200034 | Valid | Cross-site Scripting | High | 2017-05-22 | – | 5 |
| [careers.informatica.com] XSS on "isJTN"#190020 | Valid | Cross-site Scripting | High | 2017-04-07 | – | 5 |
| [now.informatica.com] Reflective XSS#106678 | Valid | Cross-site Scripting | High | 2016-12-09 | – | 5 |
| [https://life.informatica.com] - information disclose#312292 | Valid | Information Disclosure | High | 2019-07-12 | – | 4 |
| [marketplace.informatica.com] Profile stored XSS#190217 | Valid | Cross-site Scripting | High | 2017-04-19 | – | 4 |
| [community.informatica.com] - CSRF in Private Messages allows to move user's messages to Trash#45050 | Valid | Cross-Site Request Forgery | High | 2016-03-02 | – | 3 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.