Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
14
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: shopify✕
Low Privileged user can add or remove cash to/from sales register
Shopify Privilege Escalation (CAPEC-233)
Low
2021-06-16
Add new development stores without permission
Shopify Improper Access Control - Generic (CWE-284)
Medium
2021-06-04
XSS at https://exchangemarketplace.com/blogsearch
Shopify Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2021-04-09
https://themes.shopify.com::: Host header web cache poisoning lead to DoS
Shopify Uncontrolled Resource Consumption (CWE-400)
Medium
2021-04-08
[h1-2102] Partner's team member with no permission can retrieve services financial data
Shopify Improper Authorization (CWE-285)
Medium
2021-04-08
[h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege
Shopify Information Disclosure (CWE-200)
Medium
2021-04-08
Stored XSS on apps.shopify.com
Shopify Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2021-04-08
The POS app doesn't revoke the Xauth token
Shopify Insufficient Session Expiration (CWE-613)
Low
2021-04-08
Staff with no permissions could possibly list and accept billing promotions
Shopify Improper Access Control - Generic (CWE-284)
Low
2021-04-08
[h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)
Shopify Incorrect Permission Assignment for Critical Resource (CWE-732)
Medium
2021-03-25
Informations disclosure - Access to some checkout informations
Shopify
Medium
2021-03-13
Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.com
Shopify Improper Authentication - Generic (CWE-287)
Unknown
2021-02-24
Screenshot Service leaks X-ABS-App-Token
Shopify Server-Side Request Forgery (SSRF) (CWE-918)
None
2021-02-12
Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy
Shopify
None
2021-02-11
Open Redirect on Login Page of Stocky App
Shopify Open Redirect (CWE-601)
Medium
2021-02-11
xss on polaris.shopify.com/demo using postMessage
Shopify Cross-site Scripting (XSS) - DOM (CWE-79)
Low
2021-02-11
The authentication code when activating 2FA can be used again to log in
Shopify Improper Access Control - Generic (CWE-284)
Low
2021-02-11
Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT
Shopify Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2021-02-07
Exposed Slinky Instance Admin Panel
Shopify Improper Authentication - Generic (CWE-287)
None
2021-01-16
Inject page in admin panel via Shopify.API.pushState [New Payload]
Shopify Cross-site Scripting (XSS) - DOM (CWE-79)
Low
2020-12-27
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895