Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766 | Valid | File and Path Handling | High | 2026-06-05 | – | 109 |
| SQL Injection at https://████ via ███ parameterAnalysed#1935151 | Valid | SQL Injection | Critical | 2023-04-24 | – | 74 |
| 明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Analysed#2642615 | Valid | Cryptography | High | 2025-07-08 | – | 71 |
| SQL injection at ███████Analysed#2256032 | Valid | SQL Injection | Critical | 2024-01-24 | – | 63 |
| SSRF on http://www.███████/crossdomain.php via url parameterAnalysed#971590 | Valid | Server-Side Request Forgery | Critical | 2022-10-06 | – | 42 |
| Path Traversal issue at https://████/blaze/Analysed#1320084 | Valid | File and Path Handling | High | 2022-10-06 | – | 40 |
| Remote Code Execution (RCE) in a Sony WebSystemAnalysed#329572 | Valid | Deserialization and Object Injection | Critical | 2019-01-23 | – | 40 |
| LFI at http://www.████Analysed#986380 | Valid | Command and Code Injection | High | 2022-12-16 | – | 37 |
| Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████Analysed#1339430 | Valid | Command and Code Injection | Critical | 2022-07-06 | – | 26 |
| Response Manipulation leads to Admin Panel Login Bypass at https://██████/Analysed#1508661 | Valid | Authentication | High | 2022-09-12 | – | 25 |
| SQL Injection on [█████████]Analysed#1213207 | Valid | SQL Injection | High | 2022-12-07 | – | 22 |
| Remote Code Execution (RCE) in a Sony Pictures WebSystemAnalysed#330028 | Valid | Deserialization and Object Injection | Critical | 2019-01-23 | – | 22 |
| Reflected XSS on ███ via jobid parameter#1309949 | Valid | Cross-site Scripting | Medium | 2022-08-24 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.