目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,219
关联 CVE
1,854
参与项目数
342
近 7 天新增
14
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：wordpress✕
Previously created sessions continue being valid after 2FA activation
WordPress Improper Access Control - Generic (CWE-284)
Low
2023-10-07
Stored XSS on Broken Themes via filename
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2020-08-25
Clickjacking on donation page
WordPress UI Redressing (Clickjacking) (CAPEC-103)
Low
2020-07-16
antispambot does not always escape <, >, &, " and '
WordPress Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2019-09-16
Stored XSS on byddypress Plug-in via groups name
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2019-07-27
Mssing Authorization on Private Message replies (BuddyPress)
WordPress Improper Access Control - Generic (CWE-284)
Low
2019-03-08
Clickjacking In jobs.wordpress.net
WordPress UI Redressing (Clickjacking) (CAPEC-103)
Low
2018-08-22
xss - reflected
WordPress Cross-site Scripting (XSS) - Reflected (CWE-79)
Low
2018-07-24
Open API For Username enumeration
WordPress
Low
2018-07-23
Open Redirect on the nl.wordpress.net
WordPress Open Redirect (CWE-601)
Low
2018-02-22
Content Spoofing @ https://irclogs.wordpress.org/
WordPress Improper Access Control - Generic (CWE-284)
Low
2017-12-04
Self-XSS in WordPress Editor Link Modal
WordPress Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2017-11-08
[BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint
WordPress Open Redirect (CWE-601)
Low
2017-11-02
Missing SSL can leak job token
WordPress Cleartext Transmission of Sensitive Information (CWE-319)
Low
2017-11-01
Clickjacking mercantile.wordpress.org
WordPress UI Redressing (Clickjacking) (CAPEC-103)
Low
2017-09-08
Clickjacking - https://mercantile.wordpress.org/
WordPress UI Redressing (Clickjacking) (CAPEC-103)
Low
2017-08-28
Stored self-XSS in mercantile.wordpress.org checkout
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2017-07-14
Clickjacking wordcamp.org
WordPress UI Redressing (Clickjacking) (CAPEC-103)
Low
2017-06-24
Stored but [SELF] XSS in mercantile.wordpress.org
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2017-05-26
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895