Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling Analysed #3712279 Valid File and Path Handling High 2026-06-14 $5,000 176 RCE of Burp Scanner / Crawler via Clickjacking Analysed #1274695 Valid Command and Code Injection High 2023-10-10 $3,000 172 [portswigger.net] Path Traversal al /cms/audioitems Analysed #2424815 Valid File and Path Handling High 2024-04-04 – 146 DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool Analysed #3176157 Valid Server-Side Request Forgery None 2025-10-08 – 144 Build fetches jars over HTTP Analysed #506161 Valid Cryptography Medium 2019-06-10 $1,000 135 HTML Injection in Swing can disclose netNTLM hash or cause DoS Analysed #1054382 Valid Information Disclosure Medium 2021-03-29 $1,000 117 CSP bypass on PortSwigger.net using Google script resources Analysed #2279346 Valid Cross-site Scripting Medium 2024-02-18 – 113 HTML Injection in DAST Trial Request Form Confirmation Email – PortSwigger Analysed #3556892 Valid No weakness recorded Low 2026-02-26 $200 93 Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption Analysed #3625600 Valid No weakness recorded Low 2026-05-05 $200 92 Burp Suite extensions can execute arbitrary code #3014158 Informative No weakness recorded High 2025-02-26 – 85 cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party Analysed #2733994 Valid Information Disclosure Low 2025-03-13 $200 81 SMTP interaction theft via MITM Analysed #953219 Valid Cryptography Medium 2020-11-04 – 78 Title: Deceptive Manipulation of HTTP to HTTPS with VPN in Burp Suite #2230842 Informative Cryptography Medium 2023-10-31 – 71 Incorrect logic when buy one more license which may lead to extend the expire date of existing license #2461737 Informative Input Validation and Logic – 2024-04-16 – 61 Privilege Escalation by abusing non-existent path. (Windows) #440963 Duplicate Access Control Medium 2019-03-13 – 59 Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authentication Analysed #3972558 Valid No weakness recorded Medium 2026-10-15 $1,000 58 A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts Analysed #2279010 Valid Access Control Low 2024-05-20 – 51 RCE in 'Copy as Node Request' BApp via code injection Analysed #1167530 Valid Command and Code Injection None 2021-04-22 – 51 CSP Bypass and escalation of https://hackerone.com/reports/2279346 #2387458 N/A Input Validation and Logic High 2024-02-23 – 48 Changing the administrator password via admin console does not invalidate other sessions #2279041 Valid Authentication Low 2024-05-20 – 41 burp does not validate the common name of the presented collaborator server certificate #337680 Valid Cryptography Medium 2018-06-13 $1,500 39 Redirection in Repeater & Intruder Tab #1541301 Valid Open Redirect Low 2022-08-11 $150 36 XSS in IE11 on portswigger.net via Flash #182160 Valid Cross-site Scripting – 2016-11-30 – 33 JSBeautifier BApp: Race condition leads to memory disclosure #187134 Valid Memory Corruption High 2016-12-07 – 32 UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding Authen #3717354 Valid Other weaknesses None 2026-06-15 – 28 The role "CI-driven scan initiator" provides excessive read access #2276148 Valid Access Control Low 2026-01-02 – 28 Clicking "http://burp" hyperlink on FireFox CA Installation guide redirects to "burp.com" (unclaimed website). #694749 Informative Open Redirect Low 2019-09-16 – 22 Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injection #3775183 Informative Open Redirect High 2026-06-02 – 18 Business Logic, currency arbitrage - Possibility to pay less than the price in USD #1677155 Informative Input Validation and Logic Medium 2022-10-26 – 18 Information disclosure on error message #1385844 Informative Information Disclosure Low 2021-11-15 – 18 DLL Hijacking in Burp Suite Pro 2.0.19 Installer #518837 Informative Access Control Medium 2019-04-01 – 17 Leak of Platform Authentication credentials via Repeater #302651 Valid Information Disclosure Low 2018-06-13 $200 15 No Rate Limit On Regenerate Password on Portswigger #1337425 Informative No weakness recorded None 2021-09-13 – 11 Activat burp suite pro with the old license after transfared to anothe account #366129 N/A Input Validation and Logic None 2018-07-19 – 6 HTTP OPTION Method is Enabled on portswigger.net #191220 N/A Misconfiguration and Insecure Design Low 2016-12-27 – 6 Order-phishing via Payment ID URL #186862 Informative Cross-Site Request Forgery Low 2016-11-30 – 6 Browser Self XSS Protection not implemented #400785 N/A Information Disclosure – 2018-09-26 – 5 Misconfiguration: Missing Custom Error Page (CWE-12 & CWE-756) #228873 Informative No weakness recorded – 2017-05-16 – 4 Email Spoofing #206359 N/A Misconfiguration and Insecure Design Low 2017-02-14 – 3 Improper Certificate Validation #294891 Informative Cryptography Low 2018-01-02 – –