Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Django Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.comAnalysed#2965143 | Valid | Autodesk | Information Disclosure | Medium | 2025-03-18 | – | 82 |
| PHP info page disclosure in ██████████Analysed#1848780 | Valid | MTN Group | No weakness recorded | Medium | 2024-08-30 | – | 62 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | MTN Group | Information Disclosure | Medium | 2025-02-23 | – | 61 |
| Information disclosure via enabled Django Debug ModeAnalysed#2201370 | Valid | MTN Group | Information Disclosure | Medium | 2024-12-25 | – | 55 |
| phpinfo() exposed on ██████████Analysed#2641211 | Valid | Mars | Misconfiguration and Insecure Design | Medium | 2024-11-21 | – | 51 |
| Sensitive Information DisclosureAnalysed#963352 | Valid | Dropcontact | Information Disclosure | Critical | 2020-08-21 | – | 47 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,190 analysed so far), which can be wrong. Data as of 2026-11-15.