Browse / Bypasses / Input filters and sanitisers

Getting past input filters and sanitisers

Blocklists, HTML sanitisers, escaping and tag or attribute stripping. 207 disclosed reports got past one; the 100 most upvoted are below.

1. Stored XSS on imgur profileCross-site Scripting (XSS) - Stored · medium · Imgur
   614 votes
2. HEY.com email stored XSSCross-site Scripting (XSS) - Stored · critical · Basecamp
   $5,000360 votes
3. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formImproper Authorization · medium · HackerOne
   $10,000208 votes
4. Server Side Request Forgery (SSRF) in webhook functionalityServer-Side Request Forgery (SSRF) · medium · HackerOne
   $2,500140 votes
5. Spam & Clearance checks disabled with existing referenced Message-IDImproper Access Control - Generic · low · Basecamp
   $250123 votes
6. XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"Cross-site Scripting (XSS) - DOM · Shopify
   $3,000121 votes
7. Stored XSS in Snapmatic + R★Editor commentsCross-site Scripting (XSS) - Stored · high · Rockstar Games
   118 votes
8. Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node ParalysisUncontrolled Resource Consumption · critical · Monero
   97 votes
9. Stored XSS in reclamosCross-site Scripting (XSS) - Stored · high · MercadoLibre
   97 votes
10. POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)Improper Authentication - Generic · medium · CoinMate.io
    93 votes
11. Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass Cross-site Scripting (XSS) - Stored · low · Basecamp
    $33789 votes
12. Mutation Based Stored XSS on Trix Editor version latest (2.1.8)Cross-site Scripting (XSS) - Stored · critical · Basecamp
    89 votes
13. Private information exposed through GraphQL filtersInformation Disclosure · medium · HackerOne
    81 votes
14. Reflective Cross-site Scripting via Newsletter FormCross-site Scripting (XSS) - Reflected · high · Shopify
    $2,00079 votes
15. LFI and SSRF via XXE in emblem editorXML External Entities (XXE) · critical · Rockstar Games
    $1,50079 votes
16. SQL Injection in Django ORM via Unvalidated `_connector` in Q ObjectsSQL Injection · critical · Django
    77 votes
17. Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new Cross-site Scripting (XSS) - Generic · medium · GitHub
    76 votes
18. HTTP Smuggling multiple issues in Squid 3.x & squid 4.xHTTP Response Splitting · critical · Internet Bug Bounty
    74 votes
19. open redirected by host headerOpen Redirect · Localize
    73 votes
20. XSS on https://partners.acronis.com/Cross-site Scripting (XSS) - DOM · low · Acronis
    73 votes
21. Reflected cross-site scripting on multiple Starbucks assets.Cross-site Scripting (XSS) - Reflected · low · Starbucks
    72 votes
22. RXSS on ██████ via customerId parameterCross-site Scripting (XSS) - Reflected · medium · Mars
    71 votes
23. myshopify.com domain takeoverBusiness Logic Errors · medium · Shopify
    71 votes
24. WordPress Flash XSS in *flashmediaelement.swf*Cross-site Scripting (XSS) - Generic · Automattic
    70 votes
25. LFI to steal /etc/passwd - Bypass filter in the <meta property="og:image"> tag via redirect and much morePath Traversal · BugPoC
    $10069 votes
26. Path traversal by monkey-patching Buffer internalsPath Traversal · high · Internet Bug Bounty
    $2,43067 votes
27. SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)Server-Side Request Forgery (SSRF) · high · arkadiyt-projects
    65 votes
28. WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)Cross-site Scripting (XSS) - Reflected · low · Starbucks
    58 votes
29. Bypass of image rewriting / tracking blocker via srcsetInformation Disclosure · medium · Basecamp
    $1,00056 votes
30. [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user filesServer-Side Request Forgery (SSRF) · critical · h1-ctf
    56 votes
31. Reflected XSS through multiple inputs in the issue collector on JiraCross-site Scripting (XSS) - Reflected · medium · Roblox
    56 votes
32. Stored XSS via SVG Upload — check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm)Cross-site Scripting (XSS) - Stored · medium · phpBB
    55 votes
33. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
34. Link filter protection bypassOpen Redirect · medium · Valve
    55 votes
35. HTTP Request Smuggling via Unsanitized Hop-by-Hop HeadersImproper Access Control - Generic · high · Cloudflare Public Bug Bounty
    $1,50054 votes
36. SVG filter primitives bypass remote image blocking, enabling email tracking without consent.Privacy Violation · medium · Nextcloud
    53 votes
37. Bedrock Guardrails Evasion with Prompt FormattingAWS VDP
    53 votes
38. `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periodsImproper Access Control - Generic · low · Internet Bug Bounty
    $50553 votes
39. Email templates XSS by filterXSS bypassCross-site Scripting (XSS) - Generic · high · Judge.me
    $1,25051 votes
40. Stored XSS in '' Section and WAF BypassCross-site Scripting (XSS) - Stored · medium · Semrush
    50 votes
41. Cisco IOS XE instance at ████ vulnerable to CVE-██████Command Injection - Generic · critical · MTN Group
    48 votes
42. RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path fieldCode Injection · high · Kubernetes
    $2,50047 votes
43. Roundcube Webmail Style Sanitizer can be bypassed using CSS Character EscapesInformation Disclosure · medium · Nextcloud
    46 votes
44. Open Redirect via Non-Latin Subdomain in vcc-*.8x8.com/AGUI/█.phpOpen Redirect · low · 8x8
    $10046 votes
45. bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keysInsecure Default Initialization of Resource · medium · AWS VDP
    45 votes
46. position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Resource Injection · medium · Nextcloud
    44 votes
47. Stealing Users OAUTH Tokens via redirect_uri Improper Authentication - Generic · medium · BOHEMIA INTERACTIVE a.s.
    44 votes
48. XSS: `v-safe-html` is not safe enoughCross-site Scripting (XSS) - Generic · high · GitLab
    43 votes
49. SSRF - Blacklist bypass for mail account additionServer-Side Request Forgery (SSRF) · Open-Xchange
    $50043 votes
50. CRLF Injection in `--proxy-header` allows extra HTTP headers (CWE-93)CRLF Injection · curl
    42 votes
51. Stored XSS in Mermaid when viewing Markdown filesCross-site Scripting (XSS) - DOM · high · GitLab
    42 votes
52. HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attributeCross-site Scripting (XSS) - Reflected · medium · GSA Bounty
    41 votes
53. [Xenoblade Chronicles X: Definitive Edition] Improper validation of names allows injecting formatting tags and bypassing profanity filterImproper Access Control - Generic · medium · Nintendo
    40 votes
54. Rails ActionView sanitize helper bypass leading to XSS using SVG tag.Cross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    $2,40040 votes
55. Open Redirect filter bypass through '\' character via URL parameterOpen Redirect · medium · Myndr
    39 votes
56. [XSS] Style/Event Filter Bypass v3.0Cross-site Scripting (XSS) - Stored · Open-Xchange
    $50039 votes
57. urlapi: off-by-one in custom scheme validation skips last characterOff-by-one Error · high · curl
    38 votes
58. Stored XSS on issue comments and other pages which contain notesCross-site Scripting (XSS) - Stored · high · GitLab
    $3,00038 votes
59. Bypassing push rules via MRs created by EmailImproper Access Control - Generic · medium · GitLab
    36 votes
60. Windows filename sanitizer misses Unicode COM/LPT reserved device namescurl
    35 votes
61. OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)Command Injection - Generic · critical · Central Security Project
    34 votes
62. Bypass Filter and get Stored Xss Cross-site Scripting (XSS) - Stored · high · Shopify
    $3,00034 votes
63. SSRF via filter bypass due to lax checking on IPsServer-Side Request Forgery (SSRF) · medium · Nextcloud
    $25033 votes
64. Stored XSS in chat topic due to insecure emoticon parsing on any message typeCross-site Scripting (XSS) - Stored · medium · Chaturbate
    $45033 votes
65. SSRF - RSS feed, blacklist bypass (301 re-direct)Server-Side Request Forgery (SSRF) · Open-Xchange
    $85033 votes
66. Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506Cross-site Scripting (XSS) - Generic · high · X / xAI
    $56032 votes
67. URL filter bypass in Enterprise GridPhishing · low · Slack
    $10032 votes
68. SSRF - RSS feed, blacklist bypass (IP Formatting)Server-Side Request Forgery (SSRF) · Open-Xchange
    $85032 votes
69. Reflected XSS in www.dota2.comCross-site Scripting (XSS) - Reflected · medium · Valve
    32 votes
70. Code execution in "ymon" WebService, reached after bypassing the anti-loopback blacklist through YQL and HTTP redirectsCode Injection · Yahoo!
    31 votes
71. SSRF via potential filter bypass with too lax local domain checkingServer-Side Request Forgery (SSRF) · low · Nextcloud
    $25030 votes
72. Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver.Server-Side Request Forgery (SSRF) · HackerOne
    30 votes
73. Stored XSS in snapmatic commentsCross-site Scripting (XSS) - Stored · medium · Rockstar Games
    $1,00030 votes
74. Path Traversal in mbstream ExtractPath Traversal · high · MariaDB
    29 votes
75. Mailsploit: a sender spoofing bug in over 30 email clientsUser Interface (UI) Misrepresentation of Critical Information · high · Internet Bug Bounty
    29 votes
76. Bypass Filter on link of buildImproper Access Control - Generic · low · CS Money
    28 votes
77. RCE via Print function [Simplenote 1.1.3 - Desktop app] Code Injection · high · Automattic
    28 votes
78. Reflected XSS on the data.gov (WAF bypass+ Chrome XSS Auditor bypass+ works in all browsers)Cross-site Scripting (XSS) - Reflected · medium · GSA Bounty
    28 votes
79. Stored XSS filter bypass on discussion forum. "URL" tag. Cross-site Scripting (XSS) - Stored · medium · ExpressionEngine
    26 votes
80. DOMPurify bypassCross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    26 votes
81. Open redirect in semrush.comOpen Redirect · low · Semrush
    26 votes
82. SVG file that HTML Included is able to upload via File ManagerCross-site Scripting (XSS) - Stored · low · Concrete CMS
    26 votes
83. Escaping images directory in S3 bucket when saving new avatar, using Path Traversal in filenamePath Traversal · medium · Unikrn
    26 votes
84. ActionView sanitize helper bypass with 'style' and 'svg' tagsCross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    25 votes
85. xss triggered in "myshopify.com/admin/product"Cross-site Scripting (XSS) - Generic · high · Shopify
    25 votes
86. Camo Image Proxy Bypass with CSS Escape SequencesImproper Neutralization of Escape, Meta, or Control Sequences · low · Chaturbate
    25 votes
87. Stored XSS on member post feedCross-site Scripting (XSS) - Stored · high · Rockstar Games
    $1,00025 votes
88. ActionView sanitize helper bypass leading to XSS using SVG tag.Cross-site Scripting (XSS) - Generic · medium · Ruby on Rails
    24 votes
89. Bypass of privacy filter / tracking pixel blockerInformation Disclosure · medium · Nextcloud
    $10024 votes
90. Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip FlagsOS Command Injection · high · AWS VDP
    23 votes
91. Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLslow · Ruby on Rails
    23 votes
92. XSS via unicode characters in upload filenameCross-site Scripting (XSS) - Generic · medium · WordPress
    23 votes
93. CVE-2026-80256: wcurl backslash bypassPath Traversal: '.../...//' · medium · curl
    22 votes
94. #2931639 ActionView sanitize helper bypass with math-related tagsCross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    22 votes
95. ActionView sanitize helper bypass with noscriptCross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    22 votes
96. CVE-2022-23519: Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)Cross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    $2,40022 votes
97. Request line injection via HTTP/2 in Apache mod_proxyCode Injection · medium · Internet Bug Bounty
    $1,20022 votes
98. Reflected XSS via Double EncodingCross-site Scripting (XSS) - Reflected · medium · Rockstar Games
    $50022 votes
99. Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Path Traversal · medium · Weblate
    21 votes
100. Incorrect Parsing of IPv6 Zone ID in curlAuthentication Bypass by Primary Weakness · high · curl
     21 votes