Unauthenticated File Upload with CORS Wildcard and No Rate Limiting on ████████ and ████████
HackerOneEssity2026-06-29
Web
High
BUG BOUNTY WRITEUPS
File upload writeups
Unrestricted uploads leading to stored XSS, path tricks or code execution.
17 reports and writeups from 2024 to 2026. 9 carry a severity from the disclosing platform, 8 of them rated High or Critical. Last updated 2026-10-30.
Latest File upload reports
Search and filter all writeupsUnauthenticated File Upload to CDN
HackerOneEnjin2026-05-18
Web
Medium
DNN - Unrestricted Arbitrary File Upload #████████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Stored XSS in File Upload Leads to Privilege Escalation and Full Workspace Takeover
HackerOneDust2025-05-02
Web
High
Spip Preauth RCE 2024: Part 2, A Big Upload
Researcher blogSPIP2024-09-04
Web, Source Code
Not rated
Hitting the jackpot with RCE!
Medium2024-08-25$1,500 bounty
Web
Not rated
Traccar 5 Remote Code Execution Vulnerabilities
Researcher blogTraccar2024-08-23
Web, Source Code
Not rated
Unauthenticated arbitrary file upload on the https://█████/ (█████████)
HackerOneU.S. Dept Of Defense2024-08-16
Web
High
Content-Security Policy bypass with File Uploads
HackerOneRocket.Chat2024-08-10
Web
High
Exploiting authorization by nonce in WordPress plugins
Researcher blogWordfence2024-08-05
Web, Source Code
Not rated
Unauthenticated arbitrary file upload on the https://█████/ (█████.mil)
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
Low privileges (auth) Remote Command Execution - PHP file upload bypass.
HackerOneExpressionEngine2024-05-28
Web
High
From Discovery to Disclosure: ReCrystallize Server Vulnerabilities
Researcher blogReCrystallize Software2024-03-22
Web
Not rated
The Art of Intrusion: File Upload Bypass & WAF XSS Evasion in AWS S3 Demystified
Researcher blog2024-03-12
Web, Cloud
Not rated
Unrestricted File Upload at ██████████
HackerOneMars2024-02-19
Web
Critical
CVE-2023-25365 / XSS via file upload bypass
MediumOctober CMS2024-02-08
Web
Not rated
Unrestricted File Upload Lead to Stored XSS at Microsoft main domain
MediumMicrosoft2024-01-15
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.