Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Cross-site Scripting (XSS) on HackerOne careers pageAnalysed#474656 | Valid | Cross-site Scripting | Low | 2019-02-17 | $500 | 239 |
| Markdown parsing issue enables insertion of malicious tags and event handlersAnalysed#299728 | Valid | Cross-site Scripting | High | 2018-01-29 | $5,000 | 184 |
| Payload delivery via Social Media urls on H1 profileAnalysed#2483422 | Valid | File and Path Handling | Medium | 2024-07-23 | – | 138 |
| Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comAnalysed#374919 | Valid | Cross-site Scripting | Medium | 2018-08-04 | – | 129 |
| HTML Injection in email via Name fieldAnalysed#1581499 | Valid | Cross-site Scripting | Low | 2022-09-18 | $500 | 84 |
| HTML injection in email at https://www.hackerone.com/Analysed#1374017 | Valid | Command and Code Injection | Low | 2023-05-12 | – | 40 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.