Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
11
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: shopify✕
Sidekiq dashboard exposed at notary.shopifycloud.com
Shopify Information Disclosure (CWE-200)
Medium
2021-11-25
Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)
Shopify
Medium
2021-11-21
Open Redirect in www.shopify.dev Environment
Shopify Open Redirect (CWE-601)
Medium
2021-11-18
Blog posts atom feed of a store with password protection can be accessed by anyone
Shopify Information Disclosure (CWE-200)
Medium
2021-11-08
Create free Shopify application credits.
Shopify Improper Access Control - Generic (CWE-284)
Medium
2021-09-10
your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password.
Shopify Improper Authentication - Generic (CWE-287)
Medium
2021-07-12
Add new managed stores without permission
Shopify Improper Access Control - Generic (CWE-284)
Medium
2021-07-08
Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!
Shopify
Medium
2021-07-08
Add new development stores without permission
Shopify Improper Access Control - Generic (CWE-284)
Medium
2021-06-04
XSS at https://exchangemarketplace.com/blogsearch
Shopify Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2021-04-09
https://themes.shopify.com::: Host header web cache poisoning lead to DoS
Shopify Uncontrolled Resource Consumption (CWE-400)
Medium
2021-04-08
[h1-2102] Partner's team member with no permission can retrieve services financial data
Shopify Improper Authorization (CWE-285)
Medium
2021-04-08
[h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege
Shopify Information Disclosure (CWE-200)
Medium
2021-04-08
Stored XSS on apps.shopify.com
Shopify Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2021-04-08
[h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)
Shopify Incorrect Permission Assignment for Critical Resource (CWE-732)
Medium
2021-03-25
Informations disclosure - Access to some checkout informations
Shopify
Medium
2021-03-13
Open Redirect on Login Page of Stocky App
Shopify Open Redirect (CWE-601)
Medium
2021-02-11
Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT
Shopify Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2021-02-07
Low Privileged Staff Member Can Export Billing Charges
Shopify Improper Access Control - Generic (CWE-284)
Medium
2020-11-26
[Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image
Shopify Information Disclosure (CWE-200)
Medium
2020-11-21
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895