Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1110 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,247
CVE-linked
1,864
Programs
343
New This Week
22
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: deptofdefense✕
Stored XSS at ██████userprofile.aspx
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-07-08
SQL Injection in the `move_papers.php` on the https://██████████
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2020-06-25
PII/PHI data available on web https://████████Portals/22/Documents/Meetings
U.S. Dept Of Defense Cleartext Storage of Sensitive Information (CWE-312)
High
2020-06-25
Account takeover through CSRF in http://███████/██████████/default.asp
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2020-06-11
Unrestricted File Upload to ███████SubmitRequest/Index.cfm?fwa=wizardform
U.S. Dept Of Defense Violation of Secure Design Principles (CWE-657)
High
2020-06-11
Unrestricted file upload leads to stored xss on https://████████/
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-05-27
Remote Code Execution through DNN Cookie Deserialization
U.S. Dept Of Defense OS Command Injection (CWE-78)
High
2020-05-27
Full Account Take-Over of ████████ Members via IDOR
U.S. Dept Of Defense Insecure Direct Object Reference (IDOR) (CWE-639)
High
2020-05-14
Stored Xss Vulnerability on ████████
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-05-14
Domian Takeover in [███████]
U.S. Dept Of Defense Phishing (CAPEC-98)
High
2020-05-14
Sensitive Information Leaking Through Navy Website. [█████]
U.S. Dept Of Defense Cleartext Storage of Sensitive Information (CWE-312)
High
2020-05-14
Username&password is Disclosure in readme file in [https://█████████]
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-05-14
Admin Login Credential Leak for DoD Gitlab EE instance
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-05-14
Null byte Injection in https://████/
U.S. Dept Of Defense Improper Null Termination (CWE-170)
High
2020-05-14
CORS Misconfiguration Leads to Exposing User Data
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
High
2020-05-14
idor on upload profile functionality
U.S. Dept Of Defense Insecure Direct Object Reference (IDOR) (CWE-639)
High
2020-05-14
Publicly accessible Grafana install allows pivoting to Prometheus datasource
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-05-14
Reflected cross-site scripting vulnerability on a DoD website
U.S. Dept Of Defense Cross-site Scripting (XSS) - Reflected (CWE-79)
High
2020-05-14
Followup - SQL Injection - https://██████████/██████/MSI.portal
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2020-05-14
[██████████] Unauthorized access to admin panel
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
High
2020-05-14
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—