Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0Analysed#3395221	Valid	SQL Injection	High	2025-10-24	–	93
IDOR Vulnerability in Banner DeletionAnalysed#3401612	Valid	Insecure Direct Object Reference	High	2025-11-19	–	56
Blind SQL injection via clientid parameter in zone‑include.phpAnalysed#3653196	Valid	SQL Injection	High	2026-06-03	–	49
Broken Access Control allows advertiser accounts to delete trackers they do not ownAnalysed#3445710	Valid	Access Control	High	2026-01-14	–	47
PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingAnalysed#3781492	Valid	Command and Code Injection	High	2026-06-25	–	46
PHP code injection via delivery limitation logicalAnalysed#3656781	Valid	Command and Code Injection	High	2026-06-03	–	36
PHP code injection in delivery-limitation `logical` validation bypassAnalysed#3780854	Valid	Command and Code Injection	High	2026-06-25	–	35
Authorization bypass allows changing email address of other usersAnalysed#3398283	Valid	Access Control	High	2025-11-19	–	35
Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:Analysed#576504	Valid	Authentication	High	2019-05-21	–	31
Stored XSS in Conversion Statistics via Tracker NameAnalysed#3400506	Valid	Cross-site Scripting	High	2025-11-19	–	28
PHP code injection via unexpected delivery limitation parameter#3744200	Valid	Command and Code Injection	High	2026-06-03	–	11
Stored XSS on Admin Access Page - Email field#173501	Valid	Cross-site Scripting	High	2017-08-02	–	10

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.