Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
[careers.informatica.com] Reflected Cross Site Scripting to XSS Shell Possible#147196	Valid	Command and Code Injection	–	2016-12-31	–	50
[rev-app.informatica.com] - XXE#105434	Valid	Denial of Service	–	2016-08-02	–	45
[oneclickdrsfdc-test.informatica.com] Tomcat Example Scripts Exposed Unauthenticated#147161	Valid	Authentication	–	2016-11-02	–	14
[marketplace.informatica.com] - XXE#106797	Valid	Command and Code Injection	–	2016-12-09	–	14
[rev-app.informatica.com] - XXE via SAML#106865	Valid	Command and Code Injection	–	2016-12-09	–	12
[marketplace.informatica.com] - XXE#106802	Valid	Command and Code Injection	–	2016-12-09	–	12
[informatica.com] Blind SQL Injection#117073	Valid	SQL Injection	–	2016-04-19	–	11
[product360.informatica.com] Unauthenticated Apache Tomcat 8 Installation#146436	Valid	Information Disclosure	–	2016-12-08	–	9
[now.informatica.com] Reflective Xss#81191	Valid	Cross-site Scripting	–	2016-05-19	–	6
[marketplace.informatica.com] Open Redirect#123625	Valid	Open Redirect	–	2016-06-27	–	5
[now.informatica.com] Reflective XSS#106678	Valid	Cross-site Scripting	–	2016-12-09	–	5
[kb.informatica.com] Unauthenticated emails and HTML injection in email messages#139402	Valid	Cross-Site Request Forgery	–	2016-11-28	–	4
[community.informatica.com] - CSRF in Private Messages allows to move user's messages to Trash#45050	Valid	Cross-Site Request Forgery	–	2016-03-02	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,683 analysed so far), which can be wrong. Data as of 2026-11-15.