HexBrain
Sign in

Browse / Bypasses / Earlier fixes

Getting past earlier fixes

Reports that got past the fix for an earlier report. 256 disclosed reports got past one; the 100 most upvoted are below.

  1. Bypass for #488147 enables stored XSS on https://paypal.com/signin againHTTP Request Smuggling · high · PayPal
    $20,0002,687 votes
  2. Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOPrivilege Escalation · critical · Shopify
    1,922 votes
  3. Stored XSS on imgur profileCross-site Scripting (XSS) - Stored · medium · Imgur
    614 votes
  4. gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readInformation Disclosure · critical · GitLab
    $10,000410 votes
  5. Bypass of GitLab CI runner slash fix in YAML validationImproper Input Validation · critical · GitLab
    363 votes
  6. Server Side Request Forgery mitigation bypassServer-Side Request Forgery (SSRF) · high · GitLab
    350 votes
  7. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium · Shopify
    310 votes
  8. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comImproper Authentication - Generic · critical · Uber
    183 votes
  9. bypass sql injection #1109311SQL Injection · medium · Acronis
    164 votes
  10. Partial bypass of #483774 with Blind XXE on https://duckduckgo.comXML External Entities (XXE) · high · DuckDuckGo
    159 votes
  11. Discrepancy in hacker profile report count may reveal existence of a private program by publishing a reportInformation Disclosure · medium · HackerOne
    $3,000147 votes
  12. Yet Another OTP code Leaked in the API ResponseImproper Authentication - Generic · critical · MTN Group
    135 votes
  13. Private objects exposed through project importInsecure Direct Object Reference (IDOR) · critical · GitLab
    $20,000133 votes
  14. DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054)Cross-site Scripting (XSS) - DOM · low · HackerOne
    106 votes
  15. [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content"Improper Access Control - Generic · low · HackerOne
    $500104 votes
  16. Bypass a fix for report #708013Improper Restriction of Authentication Attempts · medium · Shopify
    $3,500102 votes
  17. Bypass: Stored-XSS with CSP-bypass via scoped labels' colorCross-site Scripting (XSS) - Stored · high · GitLab
    96 votes
  18. Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass Cross-site Scripting (XSS) - Stored · low · Basecamp
    $33789 votes
  19. "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statisticsInformation Disclosure · low · HackerOne
    $50086 votes
  20. Ability to link a Google account to another staff account/store owner that isn't linked yetShopify
    84 votes
  21. SSRF in api.slack.com, using slash commands and bypassing the protections.Server-Side Request Forgery (SSRF) · medium · Slack
    84 votes
  22. Blind SSRF in emblem editor (2)Server-Side Request Forgery (SSRF) · medium · Rockstar Games
    $1,50083 votes
  23. Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileViolation of Secure Design Principles · low · HackerOne
    82 votes
  24. Improper UUID validation results in bypass of #419896Improper Input Validation · high · HackerOne
    82 votes
  25. SVG Server Side Request Forgery (SSRF)Server-Side Request Forgery (SSRF) · low · Shopify
    $50081 votes
  26. Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameterCross-site Scripting (XSS) - Reflected · low · HackerOne
    80 votes
  27. Subdomain takeover #2 at info.hacker.onePrivilege Escalation · low · HackerOne
    78 votes
  28. Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterOpen Redirect · medium · Lovable VDP
    74 votes
  29. Validation message in Bounty award endpoint can be used to determine program balancesInformation Disclosure · medium · HackerOne
    73 votes
  30. Homograph fix Bypass Violation of Secure Design Principles · medium · HackerOne
    71 votes
  31. Yet Another CASB Integration Takeover of Active Integrationshigh · Cloudflare Public Bug Bounty
    68 votes
  32. SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)Server-Side Request Forgery (SSRF) · high · arkadiyt-projects
    65 votes
  33. Partial report contents leakage - via HTTP/2 concurrent stream handlingInformation Disclosure · medium · HackerOne
    $2,50064 votes
  34. MozillaVPN: Elevation of Privilege via a Logic VulnerabilityImproper Link Resolution Before File Access ('Link Following') · medium · Mozilla
    60 votes
  35. Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSCryptographic Issues - Generic · high · Node.js
    59 votes
  36. Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authenticationCross-site Scripting (XSS) - Generic · medium · PortSwigger Web Security
    $1,00058 votes
  37. Subdomain takeover #3 at info.hacker.onePrivilege Escalation · low · HackerOne
    58 votes
  38. `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periodsImproper Access Control - Generic · low · Internet Bug Bounty
    $50553 votes
  39. Internal SSRF bypass using slash commands at api.slack.comServer-Side Request Forgery (SSRF) · medium · Slack
    51 votes
  40. Bypass of fix #1370749Improper Access Control - Generic · low · Shopify
    $90050 votes
  41. Stored XSS in markdown when redacting referencesCross-site Scripting (XSS) - Stored · high · GitLab
    $5,00050 votes
  42. Subdomain takeover #4 at info.hacker.onePrivilege Escalation · low · HackerOne
    50 votes
  43. Improper access control for users with expired password, giving the user full access through API and GitImproper Access Control - Generic · medium · GitLab
    49 votes
  44. CSP Bypass and escalation of https://hackerone.com/reports/2279346Business Logic Errors · high · PortSwigger Web Security
    48 votes
  45. DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Improper Access Control - Generic · high · Internet Bug Bounty
    $4,20047 votes
  46. WG call injection in /economy/contextcommandCommand Injection - Generic · critical · Valve
    47 votes
  47. PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingCode Injection · high · Revive Adserver
    46 votes
  48. [dev.twitter.com] XSS and Open Redirect Protection BypassCross-site Scripting (XSS) - Generic · medium · X / xAI
    $1,12046 votes
  49. Two-factor authentication bypass on Grab Android AppImproper Authentication - Generic · medium · Grab
    46 votes
  50. position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Resource Injection · medium · Nextcloud
    44 votes
  51. Mattermost Server OAuth Flow Cross-Site ScriptingCross-site Scripting (XSS) - Reflected · high · Mattermost
    $90044 votes
  52. Read-Only user can execute arbitraty shell commands on AirOSCommand Injection - Generic · Ubiquiti Inc.
    44 votes
  53. Privilege Escalation via Keybase Helper (incomplete security fix)Privilege Escalation · Keybase
    42 votes
  54. Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsUncontrolled Resource Consumption · high · Node.js
    41 votes
  55. curl cookie mixed case PSL bypassInformation Exposure Through Sent Data · medium · Internet Bug Bounty
    $2,54040 votes
  56. Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixPath Traversal · high · Node.js
    39 votes
  57. Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264Information Disclosure · low · HackerOne
    39 votes
  58. Path traversal via archive.extract - CVE 2021-3281 incomplete patchPath Traversal · low · Django
    38 votes
  59. HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)Exploiting Incorrectly Configured SSL/TLS · medium · Node.js
    37 votes
  60. Bypass of my three other reports #267636 + #255894 + #271861 - (IDOR) Ability to see full name associated with other New Relic accountsInsecure Direct Object Reference (IDOR) · New Relic
    $1,50037 votes
  61. PHP code injection in delivery-limitation `logical` validation bypassCode Injection · high · Revive Adserver
    35 votes
  62. Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Path Traversal · high · Node.js
    35 votes
  63. Timeline Editor Self-XSS (Previous Fix #738072 Incomplete)Cross-site Scripting (XSS) - Reflected · low · Shopify
    $50035 votes
  64. Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionOS Command Injection · high · Weblate
    34 votes
  65. An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]Business Logic Errors · medium · LinkedIn
    34 votes
  66. Firecracker Out-of-bounds Read/Write Local Privilege Escalation VulnerabilityOut-of-bounds Read · AWS VDP
    33 votes
  67. Maintainer can leak sentry token by changing the configured URL (fix bypass)Information Disclosure · medium · GitLab
    32 votes
  68. Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506Cross-site Scripting (XSS) - Generic · high · X / xAI
    $56032 votes
  69. Cache poisoning using NULL bytes and long URLsImproper Null Termination · medium · Greenhouse.io
    32 votes
  70. wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-listOpen Redirect · medium · WordPress
    31 votes
  71. Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorizationInsecure Direct Object Reference (IDOR) · medium · Discourse
    31 votes
  72. [api-site.city-mobil.ru] Improper access control leads to information disclosure (bypass of #977597 fix)Improper Access Control - Generic · Mail.ru
    31 votes
  73. Uncontrolled Resource Consumption in any Markdown field using MermaidUncontrolled Resource Consumption · medium · GitLab
    31 votes
  74. lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)Authentication Bypass by Primary Weakness · medium · curl
    30 votes
  75. Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete FixPath Traversal · high · Ruby on Rails
    30 votes
  76. bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]Cleartext Transmission of Sensitive Information · low · curl
    30 votes
  77. [CVE-2024-54133] Possible Content Security Policy bypass in Action DispatchCross-site Scripting (XSS) - Generic · low · Internet Bug Bounty
    30 votes
  78. Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)Path Traversal · critical · Internet Bug Bounty
    $1,00029 votes
  79. Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)Server-Side Request Forgery (SSRF) · high · Rocket.Chat
    28 votes
  80. Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connectionsImproper Access Control - Generic · medium · Shopify
    28 votes
  81. Bypass for blind SSRF #281950 and #287496Server-Side Request Forgery (SSRF) · low · Infogram
    28 votes
  82. Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_sessionOpen Redirect · HackerOne
    28 votes
  83. Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Open Redirect · medium · Logitech
    27 votes
  84. [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the userBusiness Logic Errors · medium · X / xAI
    27 votes
  85. XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod)Cross-site Scripting (XSS) - Generic · high · Starbucks
    27 votes
  86. CVE-2026-3783: token leak with redirect and netrcInformation Exposure Through Sent Data · medium · curl
    26 votes
  87. Arbitrary free in curl's config file parsing.Business Logic Errors · low · curl
    26 votes
  88. Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50Path Traversal: '.../...//' · critical · Internet Bug Bounty
    $1,00026 votes
  89. Stored XSS filter bypass on discussion forum. "URL" tag. Cross-site Scripting (XSS) - Stored · medium · ExpressionEngine
    26 votes
  90. CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link Cross-Site Request Forgery (CSRF) · medium · Nextcloud
    25 votes
  91. Regexes with large repetitions on empty sub-expressions take a very long time to parseUncontrolled Resource Consumption · high · Internet Bug Bounty
    $4,00025 votes
  92. HTTP/3 Protocol Smuggling and Header Injection via CRLF in QPACK value conversionCRLF Injection · critical · curl
    24 votes
  93. Link-shortener bypass (regression on fix for #1032610)Security Through Obscurity · medium · X / xAI
    $56024 votes
  94. SafeParamsHelper::safe_params is not so safeCross-site Scripting (XSS) - Reflected · high · GitLab
    $4,00024 votes
  95. Bypass of request line length limit to DoS via cache poisoningUncontrolled Resource Consumption · medium · Greenhouse.io
    24 votes
  96. Open Redirect Protection BypassOpen Redirect · X / xAI
    24 votes
  97. [Uppy] Internal Server side request forgery (bypass of #786956)Server-Side Request Forgery (SSRF) · critical · Node.js third-party modules
    23 votes
  98. Missing ownership validation allows cross‑manager tracker–campaign linkingInsecure Direct Object Reference (IDOR) · medium · Revive Adserver
    22 votes
  99. #2931639 ActionView sanitize helper bypass with math-related tagsCross-site Scripting (XSS) - Generic · medium · Internet Bug Bounty
    22 votes
  100. XSS through image upload of contacts using svg fileCross-site Scripting (XSS) - Stored · low · Nextcloud
    $10022 votes