Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Our community
Endorsed Members
Hackevents 
Member Articles Program Activity
Browse public program activity and get an insight into which programs are receiving attention.
Browse publicly disclosed writeups from HackerOne sorted by vulnerability type. Discover which vulnerabilities are most commonly found on which programs to help aid you in your hunt.
14473 total disclosed
$8,316,548 total publicly paid out
Recently Disclosed
- No bounty Remote Code Execution (RCE) in a DoD website
- No bounty Reflected XSS on a DoD website
- No bounty Reflected XSS on a DoD website
- No bounty Reflected XSS on a DoD website
- No bounty Information disclosure vulnerability on a DoD website
- No bounty SQL Injection vulnerability in a DoD website
- No bounty Email Spoofing - SPF record set to Neutral
- $256 Web Cache Deception Attack (XSS)
- No bounty Validation bypass for queries generated for PostgreSQL
- No bounty Prototype pollution attack (mergify)
- No bounty Lack of payment type validation in dial.uber.com allows for free rides
- $500 Open Redirect in riders.uber.com
- $3000 Possibility to enumerate and bruteforce promotion codes in Uber iOS App
- $100 Full path disclosure on track.uber.com
- No bounty CTF Writeup flag{cha1n1ng_bugs_f0r_fun_4nd_pr0f1t?_or_rep0rt_an_LF1}
- No bounty List any file in the folder by using path traversal
- No bounty SSLv3 Poodle Vulnerability
- No bounty Missing Rate Limitation at /photo_videos/photoset/create
- No bounty Broken Authentication and session management OWASP A2
- No bounty flatmap-stream malicious package (distributed via the popular events-stream)
- No bounty Heap Use After Free in unserialize()
- No bounty Out of Bounds Memory Read in unserialize()
- No bounty Heap Use After Free Read in unserialize()
- $500 Hacker can request mediation for published reports
- No bounty Is the 504 Gateway Time-out error ok?
- No bounty The POODLE attack (SSLv3 supported) at status.slack.com
- No bounty Prototype pollution attack in just-extend
- No bounty Attacker can claim credentials for private program that has a published external program
- No bounty Prototype Pollution Vulnerability in mpath Package
- No bounty XSS in http://localhost:8153/go/admin/config/server/update
- No bounty Reflected XSS
- No bounty Cross Site Scripting
- No bounty Possible SSRF at URL Parameter while creating a new package repository
- No bounty Prototype pollution attack in node.extend
- $500 Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session
- No bounty Import of repositories from GitHub is tied to username instead of immutable ID
- No bounty [www.zomato.com] Blind XSS in one of the Admin Dashboard
- No bounty Unauthorized users may be able to view almost all informations related to Private projects.
- No bounty Stored XSS in merge request pages
- $500 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report
- No bounty Imperfect CSRF To Overwrite Server Config at /go/admin/restful/configuration/file/POST/xml
- $2500 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately
- No bounty Specially constructed multi-part requests cause multi-second response times; vulnerable to DoS
- No bounty reflected XSS avito.ru
- No bounty Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure )
- No bounty Global defaming of any twitter user
- No bounty Open Redirect
- No bounty Stored XSS in '' Section and WAF Bypass
- $300 TOTP Key is shorter than RFC 4226 recommended minimum
- No bounty Github wikis are editable by anyone
| Vulnerability Type | Statistics |
|---|---|
None supplied |
259 programs 1511 disclosed |
Information Disclosure |
220 programs 1378 disclosed |
Cross-site Scripting (XSS) - Generic |
139 programs 978 disclosed |
Violation of Secure Design Principles |
187 programs 799 disclosed |
Improper Authentication - Generic |
175 programs 771 disclosed |
Improper Access Control - Generic |
157 programs 732 disclosed |
Cross-site Scripting (XSS) - Reflected |
124 programs 621 disclosed |
Cross-site Scripting (XSS) - Stored |
124 programs 589 disclosed |
Cross-Site Request Forgery (CSRF) |
134 programs 488 disclosed |
Privilege Escalation |
139 programs 460 disclosed |
Business Logic Errors |
119 programs 378 disclosed |
Open Redirect |
135 programs 342 disclosed |
Insecure Direct Object Reference (IDOR) |
94 programs 339 disclosed |
Code Injection |
101 programs 333 disclosed |
Memory Corruption - Generic |
46 programs 319 disclosed |
SQL Injection |
69 programs 318 disclosed |
Denial of Service |
86 programs 315 disclosed |
Server-Side Request Forgery (SSRF) |
95 programs 278 disclosed |
Path Traversal |
58 programs 236 disclosed |
Command Injection - Generic |
82 programs 233 disclosed |
Uncontrolled Resource Consumption |
51 programs 215 disclosed |
Cryptographic Issues - Generic |
87 programs 187 disclosed |
Cross-site Scripting (XSS) - DOM |
70 programs 167 disclosed |
UI Redressing (Clickjacking) |
57 programs 131 disclosed |
Misconfiguration |
35 programs 83 disclosed |
Privacy Violation |
39 programs 80 disclosed |
HTTP Request Smuggling |
31 programs 76 disclosed |
Cleartext Storage of Sensitive Information |
39 programs 74 disclosed |
OS Command Injection |
32 programs 70 disclosed |
Use After Free |
16 programs 70 disclosed |
Improper Input Validation |
35 programs 70 disclosed |
CRLF Injection |
30 programs 64 disclosed |
Improper Restriction of Authentication Attempts |
39 programs 63 disclosed |
Buffer Over-read |
16 programs 61 disclosed |
Improper Authorization |
29 programs 57 disclosed |
Classic Buffer Overflow |
20 programs 56 disclosed |
Heap Overflow |
19 programs 54 disclosed |
Deserialization of Untrusted Data |
30 programs 52 disclosed |
Brute Force |
27 programs 51 disclosed |
Insecure Storage of Sensitive Information |
23 programs 50 disclosed |
Improper Certificate Validation |
17 programs 48 disclosed |
Cleartext Transmission of Sensitive Information |
24 programs 44 disclosed |
NULL Pointer Dereference |
14 programs 41 disclosed |
Insufficient Session Expiration |
31 programs 40 disclosed |
Information Exposure Through an Error Message |
31 programs 39 disclosed |
Insufficiently Protected Credentials |
16 programs 38 disclosed |
Out-of-bounds Read |
11 programs 37 disclosed |
Phishing |
26 programs 37 disclosed |
Information Exposure Through Directory Listing |
17 programs 35 disclosed |
XML External Entities (XXE) |
21 programs 34 disclosed |
Resource Injection |
21 programs 34 disclosed |
Man-in-the-Middle |
23 programs 31 disclosed |
Stack Overflow |
11 programs 29 disclosed |
Information Exposure Through Debug Information |
19 programs 29 disclosed |
Allocation of Resources Without Limits or Throttling |
7 programs 29 disclosed |
Integer Overflow |
9 programs 27 disclosed |
Insufficient Logging |
2 programs 24 disclosed |
Information Exposure Through Sent Data |
7 programs 23 disclosed |
Authentication Bypass Using an Alternate Path or Channel |
17 programs 22 disclosed |
Client-Side Enforcement of Server-Side Security |
14 programs 21 disclosed |
Remote File Inclusion |
15 programs 19 disclosed |
Time-of-check Time-of-use (TOCTOU) Race Condition |
12 programs 19 disclosed |
Modification of Assumed-Immutable Data (MAID) |
5 programs 19 disclosed |
HTTP Response Splitting |
11 programs 18 disclosed |
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
14 programs 18 disclosed |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
12 programs 18 disclosed |
Double Free |
5 programs 17 disclosed |
Array Index Underflow |
13 programs 17 disclosed |
Session Fixation |
12 programs 16 disclosed |
Use of a Broken or Risky Cryptographic Algorithm |
11 programs 14 disclosed |
Use of Hard-coded Credentials |
12 programs 14 disclosed |
Unrestricted Upload of File with Dangerous Type |
11 programs 14 disclosed |
Incorrect Authorization |
10 programs 14 disclosed |
Authentication Bypass by Primary Weakness |
1 programs 13 disclosed |
Forced Browsing |
11 programs 12 disclosed |
Missing Encryption of Sensitive Data |
11 programs 12 disclosed |
Externally Controlled Reference to a Resource in Another Sphere |
9 programs 12 disclosed |
Weak Cryptography for Passwords |
8 programs 11 disclosed |
Weak Password Recovery Mechanism for Forgotten Password |
9 programs 11 disclosed |
Improper Null Termination |
9 programs 11 disclosed |
Missing Required Cryptographic Step |
5 programs 10 disclosed |
Password in Configuration File |
9 programs 10 disclosed |
Plaintext Storage of a Password |
6 programs 10 disclosed |
File and Directory Information Exposure |
8 programs 9 disclosed |
Reliance on Cookies without Validation and Integrity Checking in a Security Decision |
7 programs 8 disclosed |
Inadequate Encryption Strength |
7 programs 7 disclosed |
Incorrect Calculation of Buffer Size |
5 programs 7 disclosed |
Type Confusion |
5 programs 7 disclosed |
Use of Externally-Controlled Format String |
5 programs 7 disclosed |
Buffer Underflow |
5 programs 7 disclosed |
Missing Authentication for Critical Function |
5 programs 7 disclosed |
Security Through Obscurity |
6 programs 7 disclosed |
Missing Authorization |
6 programs 7 disclosed |
Reliance on Untrusted Inputs in a Security Decision |
5 programs 6 disclosed |
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
5 programs 6 disclosed |
Improper Privilege Management |
6 programs 6 disclosed |
User Interface (UI) Misrepresentation of Critical Information |
6 programs 6 disclosed |
Off-by-one Error |
4 programs 6 disclosed |
Unverified Password Change |
4 programs 5 disclosed |
Improper Check or Handling of Exceptional Conditions |
2 programs 5 disclosed |
LDAP Injection |
2 programs 5 disclosed |
Path Traversal: '.../...//' |
5 programs 5 disclosed |
Exposure of Data Element to Wrong Session |
1 programs 5 disclosed |
Authentication Bypass |
5 programs 5 disclosed |
Use of Insufficiently Random Values |
5 programs 5 disclosed |
External Control of File Name or Path |
2 programs 5 disclosed |
LLM06: Sensitive Information Disclosure |
4 programs 5 disclosed |
Use of a Key Past its Expiration Date |
4 programs 4 disclosed |
Reusing a Nonce, Key Pair in Encryption |
3 programs 4 disclosed |
Integer Underflow |
4 programs 4 disclosed |
Improper Neutralization of HTTP Headers for Scripting Syntax |
4 programs 4 disclosed |
Improper Handling of Insufficient Permissions or Privileges |
3 programs 4 disclosed |
Use of Hard-coded Cryptographic Key |
4 programs 4 disclosed |
Execution with Unnecessary Privileges |
3 programs 4 disclosed |
Improper Handling of URL Encoding (Hex Encoding) |
4 programs 4 disclosed |
Storing Passwords in a Recoverable Format |
4 programs 4 disclosed |
Improper Validation of Certificate with Host Mismatch |
1 programs 4 disclosed |
Cache Poisoning |
2 programs 4 disclosed |
Use of Incorrectly-Resolved Name or Reference |
2 programs 4 disclosed |
Write-what-where Condition |
3 programs 3 disclosed |
Use of Inherently Dangerous Function |
3 programs 3 disclosed |
Malware |
2 programs 3 disclosed |
Exposed Dangerous Method or Function |
2 programs 3 disclosed |
XML Injection |
2 programs 3 disclosed |
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) |
3 programs 3 disclosed |
Use of Hard-coded Password |
3 programs 3 disclosed |
Incorrect Permission Assignment for Critical Resource |
3 programs 3 disclosed |
Improper Verification of Cryptographic Signature |
3 programs 3 disclosed |
Improper Neutralization of Escape, Meta, or Control Sequences |
2 programs 3 disclosed |
Expected Behavior Violation |
1 programs 3 disclosed |
Relative Path Traversal |
3 programs 3 disclosed |
LLM01: Prompt Injection |
2 programs 3 disclosed |
Inclusion of Functionality from Untrusted Control Sphere |
3 programs 3 disclosed |
Insecure Temporary File |
2 programs 3 disclosed |
Key Exchange without Entity Authentication |
2 programs 2 disclosed |
Buffer Under-read |
2 programs 2 disclosed |
Reliance on Reverse DNS Resolution for a Security-Critical Action |
2 programs 2 disclosed |
External Control of Critical State Data |
2 programs 2 disclosed |
Improper Neutralization of Value Delimiters |
1 programs 2 disclosed |
Uncontrolled Recursion |
1 programs 2 disclosed |
Exposure of Sensitive Information Due to Incompatible Policies |
2 programs 2 disclosed |
Information Exposure Through Timing Discrepancy |
2 programs 2 disclosed |
Incorrect Privilege Assignment |
1 programs 2 disclosed |
Using Components with Known Vulnerabilities |
2 programs 2 disclosed |
Missing Critical Step in Authentication |
2 programs 2 disclosed |
Cross-Site Scripting (XSS) |
2 programs 2 disclosed |
Improper Check for Certificate Revocation |
1 programs 2 disclosed |
Insufficient Verification of Data Authenticity |
2 programs 2 disclosed |
Leftover Debug Code (Backdoor) |
2 programs 2 disclosed |
Exploiting Incorrectly Configured SSL/TLS |
1 programs 2 disclosed |
Incorrect Default Permissions |
2 programs 2 disclosed |
XML Entity Expansion |
1 programs 2 disclosed |
Improper Export of Android Application Components |
1 programs 1 disclosed |
Download of Code Without Integrity Check |
1 programs 1 disclosed |
Unchecked Error Condition |
1 programs 1 disclosed |
ASI05: Unexpected Code Execution (RCE) |
1 programs 1 disclosed |
Insertion of Sensitive Information into Log File |
1 programs 1 disclosed |
Incorrect Comparison |
1 programs 1 disclosed |
Improper Handling of Highly Compressed Data (Data Amplification) |
1 programs 1 disclosed |
Missing Release of Memory after Effective Lifetime |
1 programs 1 disclosed |
Reachable Assertion |
1 programs 1 disclosed |
Acceptance of Extraneous Untrusted Data With Trusted Data |
1 programs 1 disclosed |
Reversible One-Way Hash |
1 programs 1 disclosed |
Weak Password Requirements |
1 programs 1 disclosed |
Improper Handling of Exceptional Conditions |
1 programs 1 disclosed |
Improper Initialization |
1 programs 1 disclosed |
File Content Injection |
1 programs 1 disclosed |
Improper Handling of Unexpected Data Type |
1 programs 1 disclosed |
Improper Neutralization of Whitespace |
1 programs 1 disclosed |
Improper Validation of Syntactic Correctness of Input |
1 programs 1 disclosed |
Inclusion of Sensitive Information in an Include File |
1 programs 1 disclosed |
LLM05: Supply Chain Vulnerabilities |
1 programs 1 disclosed |
LLM04: Model Denial of Service |
1 programs 1 disclosed |
Improper Link Resolution Before File Access ('Link Following') |
1 programs 1 disclosed |
Loop with Unreachable Exit Condition ('Infinite Loop') |
1 programs 1 disclosed |
Improper Neutralization of Formula Elements in a CSV File |
1 programs 1 disclosed |
Origin Validation Error |
1 programs 1 disclosed |
Reusing Session IDs (aka Session Replay) |
1 programs 1 disclosed |
Integer Overflow to Buffer Overflow |
1 programs 1 disclosed |
Reflected XSS |
1 programs 1 disclosed |
File Manipulation |
1 programs 1 disclosed |
Leveraging Race Conditions |
1 programs 1 disclosed |
Free of Memory not on the Heap |
1 programs 1 disclosed |
Encoding Error |
1 programs 1 disclosed |
Misinterpretation of Input |
1 programs 1 disclosed |
Improper Resource Shutdown or Release |
1 programs 1 disclosed |
Blind SQL Injection |
1 programs 1 disclosed |
Cleartext Storage in a File or on Disk |
1 programs 1 disclosed |
Content Spoofing |
1 programs 1 disclosed |
Inconsistency Between Implementation and Documented Design |
1 programs 1 disclosed |
Improper Synchronization |
1 programs 1 disclosed |
Use of Default Credentials |
1 programs 1 disclosed |
Path Traversal: 'dir\..\..\filename' |
1 programs 1 disclosed |
Use of Cache Containing Sensitive Information |
1 programs 1 disclosed |
Improper Removal of Sensitive Information Before Storage or Transfer |
1 programs 1 disclosed |
PHP Local File Inclusion |
1 programs 1 disclosed |
Untrusted Search Path |
1 programs 1 disclosed |
Improper Following of a Certificate's Chain of Trust |
1 programs 1 disclosed |
Wrap-around Error |
1 programs 1 disclosed |
Authentication Bypass by Spoofing |
1 programs 1 disclosed |
Insecure Default Initialization of Resource |
1 programs 1 disclosed |
Improper Handling of Unicode Encoding |
1 programs 1 disclosed |
Authentication Bypass by Capture-replay |
1 programs 1 disclosed |
LLM09:2025 Misinformation |
1 programs 1 disclosed |
Improper Validation of Certificate Expiration |
1 programs 1 disclosed |
Uncontrolled Search Path Element |
1 programs 1 disclosed |
Unprotected Transport of Credentials |
1 programs 1 disclosed |
Embedded Malicious Code |
1 programs 1 disclosed |