目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,219
关联 CVE
1,854
参与项目数
342
近 7 天新增
11
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：wordpress✕
Wordpress unzip_file path traversal
WordPress Violation of Secure Design Principles (CWE-657)
Medium
2020-01-29
Potential unprivileged Stored XSS through wp_targeted_link_rel
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2019-16773
High
2020-01-08
Stored XSS on Wordpress 5.3 via Title Post
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
High
2019-12-10
"Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons
WordPress Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2019-11-16
plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled
WordPress Violation of Secure Design Principles (CWE-657)
Unknown
2019-11-03
[FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2019-10-11
antispambot does not always escape <, >, &, " and '
WordPress Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2019-09-16
Parameter tampering : Price Manipulation of Products
WordPress Business Logic Errors (CWE-840)
Unknown
2019-08-29
Reflected XSS: Taxonomy Converter via tax parameter
WordPress Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2019-08-28
Reflected XSS on https://make.wordpress.org via 'channel' parameter
WordPress Cross-site Scripting (XSS) - Reflected (CWE-79)
High
2019-08-26
Add users to groups who have restricted group invites
WordPress Improper Access Control - Generic (CWE-284)
High
2019-07-27
Stored XSS on byddypress Plug-in via groups name
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2019-07-27
WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the Server
WordPress Cryptographic Issues - Generic (CWE-310)
High
2019-07-22
Stored XSS Vulnerability
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
High
2019-07-18
CSRF to HTML Injection in Comments
WordPress Cross-Site Request Forgery (CSRF) (CWE-352)
High
2019-05-13
Stored XSS in Private Message component (BuddyPress)
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Critical
2019-03-08
Mssing Authorization on Private Message replies (BuddyPress)
WordPress Improper Access Control - Generic (CWE-284)
Low
2019-03-08
Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonce
WordPress Business Logic Errors (CWE-840)
High
2019-02-14
Multiple stored XSS in WordPress
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Unknown
2018-11-16
Reflected Swf XSS In ( plugins.svn.wordpress.org )
WordPress
Medium
2018-09-27
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895