Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| DoS on PayPal via web cache poisoningAnalysed#622122 | Valid | PayPal | Denial of Service | Medium | 2019-10-23 | $9,700 | 851 |
| H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsAnalysed#422944 | Valid | Shopify | Command and Code Injection | Medium | 2020-02-06 | – | 830 |
| Stored XSS on imgur profileAnalysed#484434 | Valid | Imgur | Cross-site Scripting | Medium | 2019-03-02 | – | 614 |
| SSRF in Exchange leads to ROOT access in all instances#341876 | Valid | Shopify | Server-Side Request Forgery | Medium | 2018-05-23 | – | 587 |
| Shopify Stocky App OAuth MisconfigurationAnalysed#740989 | Valid | Shopify | Access Control | Medium | 2019-12-11 | – | 527 |
| Reflected XSS in OAUTH2 login flowAnalysed#697099 | Valid | LY Corporation | Cross-site Scripting | Medium | 2020-04-21 | $1,990 | 489 |
| profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434 | Valid | HackerOne | Denial of Service | Medium | 2020-03-25 | – | 475 |
| CRLF injectionAnalysed#446271 | Valid | X / xAI | No weakness recorded | Medium | 2019-12-25 | – | 439 |
| Denial of service to WP-JSON API by cache poisoning the CORS allow origin headerAnalysed#591302 | Valid | Automattic | Denial of Service | Medium | 2020-04-16 | – | 405 |
| Read-only application can publish/delete fleetsAnalysed#1032468 | Valid | X / xAI | Access Control | Medium | 2021-01-04 | – | 398 |
| H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsAnalysed#423467 | Valid | Shopify | Input Validation and Logic | Medium | 2019-11-04 | – | 372 |
| [cs.money] Open Redirect Leads to Account TakeoverAnalysed#905607 | Valid | CS Money | Authentication | Medium | 2020-09-30 | – | 357 |
| Reflected XSS in TikTok endpointsAnalysed#1350887 | Valid | TikTok | Cross-site Scripting | Medium | 2021-10-22 | – | 356 |
| Hackerone is not properly deleting user idAnalysed#1133118 | Valid | HackerOne | Input Validation and Logic | Medium | 2021-06-11 | – | 356 |
| CRLF Injection in urllibAnalysed#590020 | Valid | Internet Bug Bounty | Injection and Smuggling | Medium | 2020-05-06 | $1,000 | 341 |
| Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationAnalysed#796956 | Valid | Shopify | No weakness recorded | Medium | 2020-04-01 | – | 310 |
| CSRF on connecting Paypal as Payment ProviderAnalysed#807924 | Valid | Shopify | Cross-Site Request Forgery | Medium | 2020-04-10 | – | 304 |
| Information Disclosure in /skills callAnalysed#188719 | Valid | HackerOne | Information Disclosure | Medium | 2017-01-05 | $10,000 | 287 |
| Team member with Program permission only can escalate to Admin permissionAnalysed#605720 | Valid | HackerOne | Access Control | Medium | 2019-06-26 | – | 268 |
| Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsAnalysed#1849626 | Valid | Stripe | Input Validation and Logic | Medium | 2023-02-25 | $5,000 | 266 |
| DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comAnalysed#1695604 | Valid | Shopify | Other weaknesses | Medium | 2025-06-04 | $3,800 | 266 |
| OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageAnalysed#861940 | Valid | Semrush | Information Disclosure | Medium | 2020-06-18 | – | 265 |
| SSRF in graphQL query (pwapi.ex2b.com)Analysed#1864188 | Valid | EXNESS | Server-Side Request Forgery | Medium | 2023-07-24 | $3,000 | 261 |
| XXE on sms-be-vip.twitter.com in SXMP ProcessorAnalysed#248668 | Valid | X / xAI | Injection and Smuggling | Medium | 2017-07-26 | – | 258 |
| Denial of service via cache poisoningAnalysed#409370 | Valid | HackerOne | Denial of Service | Medium | 2018-12-22 | $2,500 | 253 |
| Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainAnalysed#565883 | Valid | GitLab | Input Validation and Logic | Medium | 2019-08-30 | – | 249 |
| [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationAnalysed#426165 | Valid | Eternal | No weakness recorded | Medium | 2018-11-28 | $550 | 246 |
| Shopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationAnalysed#2885269 | Valid | Shopify | Access Control | Medium | 2025-05-15 | – | 245 |
| XSS at jamfpro.shopifycloud.comAnalysed#1444682 | Valid | Shopify | Cross-site Scripting | Medium | 2023-02-02 | $9,400 | 240 |
| Race condition in performing retest allows duplicated paymentsAnalysed#429026 | Valid | HackerOne | Race Conditions | Medium | 2018-12-27 | – | 240 |
| Infromation Disclosure To Use of Hard-coded Cryptographic Key#2353237 | Duplicate | Cryptography | Medium | 2024-02-06 | – | 238 | |
| Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058 | Valid | Roblox | Insecure Direct Object Reference | Medium | 2020-04-26 | – | 233 |
| [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)Analysed#511044 | Valid | Eternal | Input Validation and Logic | Medium | 2019-03-18 | – | 229 |
| Static files on HackerOne.com can be made inaccessible through Cache Poisoning attackAnalysed#1181946 | Valid | HackerOne | Denial of Service | Medium | 2021-12-22 | – | 228 |
| Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationAnalysed#2937622 | Valid | HackerOne | Information Disclosure | Medium | 2025-05-31 | – | 226 |
| Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateAnalysed#1082847 | Valid | Superhuman (formerly Grammarly) | Input Validation and Logic | Medium | 2021-03-01 | – | 223 |
| Google Docs link in JS files allows editing & reading survey informationAnalysed#2180521 | Valid | HackerOne | Information Disclosure | Medium | 2023-11-04 | – | 217 |
| HackerOne Jira integration plugin Leaked JWT to unauthorized jira usersAnalysed#1103582 | Valid | HackerOne | Authentication | Medium | 2021-04-01 | $3,000 | 213 |
| IDOR vulnerability in unreleased HackerOne Copilot featureAnalysed#2218334 | Valid | HackerOne | Insecure Direct Object Reference | Medium | 2023-10-25 | – | 210 |
| Uploading large payload on domain instructions causes server-side DoSAnalysed#887321 | Valid | HackerOne | Denial of Service | Medium | 2020-06-20 | $2,500 | 210 |
| Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formAnalysed#418767 | Valid | HackerOne | Access Control | Medium | 2018-10-31 | $10,000 | 208 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Valid | TikTok | Cross-site Scripting | Medium | 2022-08-19 | – | 201 |
| Stealing Facebook OAuth Code Through Screenshot viewerAnalysed#488269 | Valid | Rockstar Games | Information Disclosure | Medium | 2019-03-05 | – | 200 |
| Blocked user can see live videoAnalysed#1067967 | Valid | TikTok | Information Disclosure | Medium | 2021-05-28 | $418 | 198 |
| TikTok 2FA BypassAnalysed#1247108 | Valid | TikTok | Access Control | Medium | 2023-02-03 | $1,564 | 194 |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosAnalysed#1034257 | Valid | HackerOne | Misconfiguration and Insecure Design | Medium | 2021-03-25 | – | 194 |
| XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)Analysed#220852 | Valid | Rockstar Games | Cross-site Scripting | Medium | 2021-06-03 | – | 194 |
| Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuseAnalysed#286740 | Valid | Internet Bug Bounty | Cryptography | Medium | 2017-11-03 | – | 191 |
| Unauthorized access to metadata of undisclosed reports that were retestedAnalysed#871749 | Valid | HackerOne | Information Disclosure | Medium | 2020-06-05 | – | 189 |
| [PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443 | Valid | PayPal | Open Redirect | Medium | 2019-02-07 | – | 188 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.