Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Potential pre-auth RCE on Twitter VPNAnalysed#591295 | Valid | X / xAI | Command and Code Injection | Critical | 2019-08-10 | $20,160 | 1,246 |
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Valid | Snapchat | Command and Code Injection | Critical | 2021-07-29 | $25,000 | 1,191 |
| H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsAnalysed#422944 | Valid | Shopify | Command and Code Injection | Medium | 2020-02-06 | – | 830 |
| Remote Code Execution on www.semrush.com/my_reports on Logo uploadAnalysed#403417 | Valid | Semrush | Command and Code Injection | Critical | 2019-06-24 | – | 824 |
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | GitLab | Command and Code Injection | Critical | 2019-12-19 | $12,000 | 777 |
| Webshell via File Upload on ecjobs.starbucks.com.cnAnalysed#506646 | Valid | Starbucks | Command and Code Injection | Critical | 2019-11-13 | – | 688 |
| Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928 | Valid | Ubiquiti Inc. | Command and Code Injection | Critical | 2019-11-08 | – | 553 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | GitLab | Command and Code Injection | Critical | 2019-07-17 | $12,000 | 542 |
| Remote code execution on Basecamp.comAnalysed#365271 | Valid | Basecamp | Command and Code Injection | Critical | 2020-11-26 | $5,000 | 417 |
| Remote Command Execution via Github importAnalysed#1679624 | Valid | GitLab | Command and Code Injection | Critical | 2022-10-06 | $33,510 | 392 |
| RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Analysed#1609965 | Valid | GitLab | Command and Code Injection | Critical | 2022-09-13 | $33,510 | 387 |
| Code injection possible with malformed Nextcloud Talk chat commandsAnalysed#851807 | Valid | Nextcloud | Command and Code Injection | High | 2020-06-02 | – | 317 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Valid | TikTok | Command and Code Injection | Critical | 2021-04-15 | – | 312 |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceAnalysed#592400 | Valid | Starbucks | SQL Injection | Critical | 2019-07-22 | – | 236 |
| RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`Analysed#212696 | Valid | Imgur | Command and Code Injection | Critical | 2017-04-26 | – | 229 |
| Git flag injection leading to file overwrite and potential remote code executionAnalysed#653125 | Valid | GitLab | Command and Code Injection | Critical | 2019-12-19 | $3,500 | 169 |
| Apache Flink RCE via GET jar/plan API EndpointAnalysed#1418891 | Valid | Aiven Ltd | Command and Code Injection | Critical | 2022-11-08 | $6,000 | 134 |
| Git flag injection - Search API with scope 'blobs'Analysed#682442 | Valid | GitLab | Command and Code Injection | High | 2019-12-15 | $7,000 | 130 |
| Remote Code Execution via Extract App PluginAnalysed#546753 | Valid | Nextcloud | Command and Code Injection | High | 2019-05-30 | – | 124 |
| SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.aiAnalysed#1842674 | Valid | Krisp | Deserialization and Object Injection | Critical | 2023-02-22 | – | 119 |
| Public instance of Jenkins on https://██████████/ with /script enabledAnalysed#768266 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2020-01-31 | – | 118 |
| Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/Analysed#2083771 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2024-12-18 | – | 114 |
| OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)Analysed#3637898 | Valid | AWS VDP | Command and Code Injection | High | 2026-07-06 | – | 111 |
| No SearchEngine sanatizing can lead to command injectionAnalysed#495382 | Valid | Notepad++ | Command and Code Injection | Medium | 2019-06-06 | – | 99 |
| [insideok.ru] Remote Command Execution via file upload.Analysed#666716 | Valid | ok.ru | Command and Code Injection | Critical | 2019-09-20 | – | 98 |
| Remote Code Execution in ██████Analysed#710864 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2020-05-11 | – | 94 |
| Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-checkAnalysed#2325023 | Valid | GitHub | Command and Code Injection | High | 2024-09-17 | – | 88 |
| RCE on Wordpress websiteAnalysed#2248328 | Valid | Nextcloud | Deserialization and Object Injection | Critical | 2023-12-28 | – | 83 |
| Privilege-0 to Root Privilege Escalation on EdgeSwitchAnalysed#511025 | Valid | Ubiquiti Inc. | Access Control | High | 2019-03-31 | – | 82 |
| Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forwardAnalysed#2332623 | Valid | GitHub | Command and Code Injection | High | 2024-09-13 | – | 80 |
| GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionAnalysed#955016 | Valid | GitLab | Command and Code Injection | High | 2020-11-04 | – | 77 |
| Public Jenkins instance with /script enabledAnalysed#403402 | Valid | Ubiquiti Inc. | Command and Code Injection | Critical | 2018-09-10 | – | 74 |
| RCE on facebooksearch.algolia.comAnalysed#134321 | Valid | Algolia | Command and Code Injection | – | 2016-10-01 | $500 | 74 |
| Grafana RCE via SMTP server parameter injectionAnalysed#1200647 | Valid | Aiven Ltd | Injection and Smuggling | Critical | 2022-11-08 | $5,000 | 72 |
| CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/Analysed#2742457 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2024-10-25 | – | 62 |
| OS Command Injection via egrep in Rake::FileListAnalysed#651518 | Valid | Ruby | Command and Code Injection | – | 2019-08-29 | – | 62 |
| Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injectionAnalysed#2332551 | Valid | GitHub | Command and Code Injection | High | 2024-09-13 | – | 61 |
| Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ngAnalysed#2329466 | Valid | GitHub | Command and Code Injection | High | 2024-09-13 | – | 61 |
| Remote Code Execution at http://tw.corp.ubnt.comAnalysed#269066 | Valid | Ubiquiti Inc. | Command and Code Injection | Critical | 2017-11-29 | – | 61 |
| Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10Analysed#2817658 | Valid | Trellix | Command and Code Injection | Critical | 2025-01-12 | – | 60 |
| CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash exampleAnalysed#1776476 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2023-01-05 | $4,000 | 60 |
| insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)Analysed#3090123 | Valid | Mars | Deserialization and Object Injection | Critical | 2025-05-12 | – | 59 |
| Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URLAnalysed#949361 | Valid | Valve | Command and Code Injection | Critical | 2024-07-30 | – | 59 |
| CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default ServletAnalysed#3031518 | Valid | Internet Bug Bounty | Deserialization and Object Injection | High | 2025-04-27 | $4,323 | 56 |
| RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.comAnalysed#2221404 | Valid | Mozilla | Command and Code Injection | Low | 2024-12-08 | $500 | 56 |
| Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browserAnalysed#832750 | Valid | Valve | Memory Corruption | High | 2020-08-19 | – | 55 |
| CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAGAnalysed#2705661 | Valid | Internet Bug Bounty | No weakness recorded | Low | 2024-12-07 | – | 54 |
| Git flag injection leads to arbitrary file writeAnalysed#1070247 | Valid | Phabricator | File and Path Handling | High | 2021-07-25 | – | 54 |
| `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periodsAnalysed#2721478 | Valid | Internet Bug Bounty | No weakness recorded | Low | 2024-11-22 | $505 | 53 |
| Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_largeAnalysed#840243 | Valid | Valve | Command and Code Injection | Critical | 2024-07-30 | – | 53 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.