Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS in Email Templates via link#1376672 | Valid | Cross-site Scripting | – | 2021-11-18 | $500 | 81 |
| Blind XSS via Feedback form.#1339034 | Valid | Cross-site Scripting | – | 2022-05-03 | – | 57 |
| Email templates XSS by filterXSS bypass#1404804 | Valid | Cross-site Scripting | – | 2022-05-25 | $1,250 | 51 |
| IDOR: leak buyer info & Publish/Hide foreign comments#1410498 | Valid | Insecure Direct Object Reference | – | 2022-03-31 | $1,250 | 47 |
| Log4j RCE on https://judge.me/reviews#1427589 | Valid | Command and Code Injection | – | 2021-12-21 | $50 | 40 |
| Stored XSS in "product type" field executed via product filters#1404770 | Valid | No weakness recorded | – | 2022-04-26 | $500 | 30 |
| Race condition on https://judge.me/people#1566017 | Valid | Race Conditions | – | 2022-08-01 | $250 | 26 |
| Stored XSS in Public Profile Reviews#1398285 | Valid | Cross-site Scripting | – | 2023-02-01 | $250 | 25 |
| Improper Access Control in Ali Express Importer#1609955 | Valid | Access Control | – | 2023-02-01 | – | 21 |
| XSS in Widget Review Form Preview in settings#1595905 | Valid | Cross-site Scripting | – | 2022-09-29 | – | 16 |
| stored XSS on AliExpress Review Importer/Products when delete product#1425882 | Valid | Cross-site Scripting | – | 2022-03-31 | $500 | 15 |
| Self-XSS due to image URL can be eploited via XSSJacking techniques in review email#1397940 | Valid | No weakness recorded | – | 2023-02-01 | – | 14 |
| The response shows the nginx version#1395068 | Informative | Information Disclosure | – | 2021-11-11 | – | 12 |
| Stored XSS in Question edit for product name (bypass #1416672)#1428207 | Valid | Cross-site Scripting | – | 2022-03-31 | $500 | 11 |
| Stored XSS in Question edit from product name#1416672 | Valid | Cross-site Scripting | – | 2022-03-31 | $500 | 7 |
| Error Page Content Spoofing or Text Injection#1421413 | N/A | Input Validation and Logic | – | 2021-12-13 | – | 6 |
| HTML INJECTION (STORED)#1252155 | Informative | Cross-site Scripting | – | 2023-02-01 | – | 6 |
| HTML injection in review content#1036995 | Informative | Command and Code Injection | – | 2021-12-17 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.