Web
Not rated
BUG BOUNTY WRITEUPS
XSS writeups
Cross-site scripting is still the bug most hunters find first. These reports show where it hides now: rich text editors, markdown renderers, file previews, postMessage handlers and the odd CSP bypass.
310 reports and writeups from 2024 to 2026. 200 carry a severity from the disclosing platform, 42 of them rated High or Critical. Last updated 2026-10-30.
Latest XSS reports
Search and filter all writeupsCross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce
HackerOneBasecamp2026-10-28
Web
High
From POST-Based XSS to Full Account Takeover
Medium2026-10-28
Web
Not rated
CSRF and XSS: How a Valid Login Can Be Misused
Medium2026-10-27
Web
Not rated
>> XSS vs SQL Injection (SQLi): Understanding Two Common Web Application Vulnerabilities
Medium2026-10-27
Web
Not rated
The WAF Said No: Finding XSS Through JavaScript Recon
Medium2026-10-27
Web
Not rated
6 of 8 SVG Sanitizers Got Broken: How a "Safe" Image Upload Can Run JavaScript (SVG XSS)
Medium2026-10-27
Web
Not rated
Web
Not rated
Large-site Quick Edit reparses a Contributor display name into active HTML
HackerOneWordPress2026-10-21
Web
Medium
Web
Not rated
Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML
HackerOneMozilla2026-10-14$3,000 bounty
Web
High
Web, Cloud
Not rated
Blind XSS Accepted, No Payout: A Bug Bounty Lesson.
Medium2026-10-12
Web
Not rated
ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754
HackerOneRuby on Rails2026-10-10
Web
Medium
Menemukan Bug XSS di Web Marketplace Jombang
Medium2026-10-07
Web
Not rated
One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML
HackerOneBasecamp2026-10-02
Web
High
SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )
HackerOneDuckDuckGo2026-09-17$500 bounty
Web
Medium
Action Text to_markdown: / content escapes its delimiter, letting a stored body inject arbitrary Markdown
HackerOneRuby on Rails2026-09-12
Web
Medium
Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`
HackerOneWordPress2026-08-28
Web
Critical
Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)
HackerOneEssity2026-08-27
Web
Critical
@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
HackerOne8x82026-08-25
Web, Cloud
Low
URI scheme validation bypass in ActionText `to_markdown` via user-supplied ` ` marker tag
HackerOneRuby on Rails2026-08-24
Web
Medium
Stored HTML Injection (CWE-79) via Livechat Visitor Name
HackerOneRocket.Chat2026-08-20
Web
Low
Stored XSS in nameserver field on account settings page
HackerOneTucows (VDP)2026-07-31
Web
Low
Stored XSS via SVG Upload — check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm)
HackerOnephpBB2026-07-30
Web
Medium
Stored XSS in Rocket.Chat HTML File Export — Unauthenticated Entry via LiveChat
HackerOneRocket.Chat2026-07-16
Web
Medium
Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass
HackerOneBasecamp2026-07-14$337 bounty
Web
Low
Reflected XSS in legacy CGI script /cgi-bin/████████.pl on ████████ via `████████` parameter
HackerOneEssity2026-06-30
Web
High
Content-Type Override to Stored XSS on Public Objects
Researcher blog2026-06-30
Web, Cloud
Not rated
Stored XSS in maintenance tools via unescaped entity names
HackerOneRevive Adserver2026-06-25
Web
Medium
Reflected XSS in stats‑video.php via improperly encoded URL parameters
HackerOneRevive Adserver2026-06-25
Web
Medium
Reflected XSS via unsanitised refresh parameter in zone invocation tag
HackerOneRevive Adserver2026-06-25
Web
Medium
Unauthenticated reflected XSS in Essity "Network Toolbox" CGI (████████ ████████
HackerOneEssity2026-06-23
Web
High
Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering
HackerOneShopify2026-06-18$1,600 bounty
Web, AI
Medium
Reflected Cross-Site Scripting (XSS) found on IBM.com domain
HackerOneIBM2026-06-15
Web
Not rated
Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser
HackerOneRevive Adserver2026-06-03
Web
Not rated
Reflected XSS via clientid parameter in zone‑include.php
HackerOneRevive Adserver2026-06-03
Web
Medium
Stored XSS via Full Name field in userlog email entries
HackerOneRevive Adserver2026-06-03
Web
Medium
Stored XSS in attachment-display exploitable through SameSite
HackerOneNextcloud2026-04-19
Web, Cloud
Medium
[Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuth
HackerOneCloudflare Public Bug Bounty2026-04-14
Web, Cloud
High
DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover
HackerOneBasecamp2026-04-14
Web
High
[Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth
HackerOneCloudflare Public Bug Bounty2026-04-14
Web, Cloud
High
AI Playground XSS to steal user-chat messages and access to connected MCP Server
HackerOneCloudflare Public Bug Bounty2026-02-26
Web, Cloud, AI
Low
uXSS on Samsung Browser [CVE-2025-58485 · SVE-2025-1879]
Researcher blog2026-02-23
Android
Not rated
XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution
HackerOneAutomattic2026-02-18
Web
Not rated
When Two Parsers Disagree: Exploiting Query String Differentials for XSS
Researcher blog2026-02-10
Web
Not rated
[revive-adserver] Reflected XSS in Banner Delivery Options via cap parameter
HackerOneRevive Adserver2026-01-14
Web
Medium
Reflected XSS in afr.php
HackerOneRevive Adserver2026-01-14
Web
Medium
Reflected XSS in banner-acl.php and channel-acl.php via executionorder
HackerOneRevive Adserver2026-01-14
Web
Medium
Reflected XSS Vulnerability in SSL VPN Endpoint — CVE-2025-0133
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Medium
Cross-Site Scripting via 'wikitext' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Reflected XSS via user Parameter on getconfig.esp Endpoint
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Medium
POST XSS - data[account][id] parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Reflected Cross-Site Scripting (XSS)
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via 'autoPlay' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Reflected XSS via user Parameter in /ssl-vpn/getconfig.esp
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) Vulnerability via parameter c0-id + Akamai Firewall Bypass
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
CVE‑2025‑4123 — Grafana Open Redirect → Stored XSS → SSRF (Full Read) at ██████
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Cross-Site Scripting via URL on ████████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via 'EVENT_DESCRIPTION' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ███████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Reflected XSS via user parameter on getconfig.esp endpoint
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Medium
Cross-Site Scripting via 'RAISED_FUNDS_DESC' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ██████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
POST XSS - fields[account][lastname] parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via 'description_extra' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via 'fname' parameter in ███
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via 'return_link_url' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via URL on ███████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via 'currentImage' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ██████████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting via URL on ███████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Reflected XSS in `Telerik.ReportViewer.axd` with F5 BIG-IP ASM Bypass on `████`
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) Vulnerability via POST Method + Akamai Firewall Bypass
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ███████
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
POST XSS - data[type] parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
POST XSS - fields[account][firstname] parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Stored XSS via SVG Upload in chat.line.biz
HackerOneLY Corporation2026-01-05$100 bounty
Web
Low
Stored XSS in contacts app via organisation and title field
HackerOneNextcloud2026-01-04$100 bounty
Web, Cloud
Low
RXSS in https://jp.mcafee.com/apps/mdm/jp/3.0_asp/
HackerOneTrellix2025-12-19
Web
Medium
Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO
HackerOneCloudflare Public Bug Bounty2025-12-16
Web, Cloud, AI
Low
DOM XSS to Account Takeover: not-so-dirty dancing in a GIS SDK
Researcher blog2025-12-07
Web
Not rated
Stored XSS Vulnerability via SVG File
HackerOneNextcloud2025-12-05$150 bounty
Web, Cloud
Medium
runs javascript on powershell when it shouldnt
HackerOnecurl2025-11-26
Web
Not rated
Stored-XSS in Banner Name field
HackerOneRevive Adserver2025-11-19
Web
Low
Reflected XSS in account-preferences-plugin.php
HackerOneRevive Adserver2025-11-19
Web
Medium
Stored-XSS in campaign name displayed in Banners modal
HackerOneRevive Adserver2025-11-19
Web
Medium
Reflected XSS in /admin/banner-zone.php (v6.0.0+)
HackerOneRevive Adserver2025-11-19
Web
Medium
Stored XSS on inventory-retrieve.php
HackerOneRevive Adserver2025-11-19
Web
Low
Stored XSS in Conversion Statistics via Tracker Name
HackerOneRevive Adserver2025-11-19
Web
High
Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2
HackerOneRevive Adserver2025-10-22
Web
Medium
`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it
HackerOneCloudflare Public Bug Bounty2025-09-30$550 bounty
Web, Cloud, AI
Medium
Stored XSS via LINK Name.
HackerOneInsightly2025-09-23
Web
High
Stored XSS in Email Notifcation
HackerOneInsightly2025-09-19
Web
Medium
DOM XSS on www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom
HackerOneInsulet Corporation2025-09-13
Web
Medium
Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).
HackerOneTikTok2025-09-11
Web, API
Medium
RXSS on stores on *█████████/visitorRegistration.pml via destination parameter
HackerOneMars2025-09-02
Web
Medium
Stored XSS in AREA tutorials
HackerOneAutodesk2025-08-25
Web
High
RXSS on ██████ via customerId parameter
HackerOneMars2025-07-28
Web
Medium
XSS on Amazon Aquisition: elemental
HackerOneAWS VDP2025-07-22
Web, Cloud
High
Stored Cross-Site Scripting (XSS) in "Add Contact" Name Field – MainWP Plugin
HackerOneMainWP2025-07-17$50 bounty
Web
Not rated
Reflected XSS in "Cost Tracker" Notes Field
HackerOneMainWP2025-07-17$50 bounty
Web
Low
Reflected XSS in "Create Category" Functionality of Post Creation Module
HackerOneMainWP2025-07-17$50 bounty
Web
Low
Reflected XSS in "Manage Tags" Notes Field
HackerOneMainWP2025-07-17$50 bounty
Web
Low
Reflected XSS in "Client Notes" Field
HackerOneMainWP2025-07-13$50 bounty
Web
Low
Potential XSS vector in curl via unsanitized URL parameter handling
HackerOnecurl2025-06-30
Web
High
RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspx
HackerOneYelp2025-06-30
Web
Medium
Mutation Based Stored XSS on Trix Editor version latest (2.1.8)
HackerOneBasecamp2025-06-27
Web
Critical
[XSS] Reflected XSS via POST request in (███████)
HackerOneMars2025-06-12
Web
Medium
Breaking Out of Restricted Mode: XSS to RCE in Visual Studio Code
Researcher blog2025-05-14
Web
Not rated
Stored XSS in File Upload Leads to Privilege Escalation and Full Workspace Takeover
HackerOneDust2025-05-02
Web
High
Reflected XSS Vulnerability in SVG File at area-resources-stg.autodesk.com
HackerOneAutodesk2025-04-17
Web
Medium
Reflected XSS In Marketing Reports Page On *.myshopify.com/admin
HackerOneShopify2025-04-15
Web
Medium
1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizer
HackerOneRuby on Rails2025-04-09
Web
Medium
Stored Cross-Site Scripting found in custom integration app on https://admin.b360.autodesk.com.
HackerOneAutodesk2025-03-14
Web
Medium
Stored Cross-Site Scripting in mercadopago.com.ar
HackerOneMercadoLibre2025-03-13
Web
High
CSRF to Reflected XSS at echo.urbandictionary.biz via spoofing content type
HackerOneUrban Dictionary2025-03-11
Web
Medium
Stored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/
HackerOneAutodesk2025-02-26
Web
High
[CVE-2024-54133] Possible Content Security Policy bypass in Action Dispatch
HackerOneInternet Bug Bounty2025-02-06
Web
Low
ActionView sanitize helper bypass with noscript
HackerOneInternet Bug Bounty2025-02-06
Web
Medium
#2931639 ActionView sanitize helper bypass with math-related tags
HackerOneInternet Bug Bounty2025-02-06
Web
Medium
ActionView sanitize helper bypass with 'style' and 'svg' tags
HackerOneInternet Bug Bounty2025-02-06
Web
Medium
ActionView sanitize helper bypass with style
HackerOneInternet Bug Bounty2025-02-06
Web
Medium
XSS on using the legacy "Graphie To Png" API
HackerOneKhan Academy2025-02-06
Web, API
Critical
Action Text XSS (Rails 7.1.x)
HackerOneRuby on Rails2025-02-04
Web
Medium
XSS vulnerability found in javascript code of https://███.mil
HackerOneU.S. Dept Of Defense2025-01-24
Web
Medium
XSS found in https://www.████████.mil
HackerOneU.S. Dept Of Defense2025-01-24
Web
Medium
Stored XSS via SMTP Error Message
HackerOneXVIDEOS2025-01-24$250 bounty
Web
Low
POST based Cross-Site Scripting on IBM research endpoint
HackerOneIBM2025-01-23
Web, API
Medium
WAF bypass and java script incomplete handling of Unicode characters might leads to dom-xss
HackerOneDoppler2025-01-13
Web
Not rated
[oem.acronis.com] Reflected Cross Site Scripting
HackerOneAcronis2024-12-28$100 bounty
Web
Medium
DOM Based Reflected Cross Site Scripting
HackerOneMTN Group2024-12-25
Web
High
Reflected XSS on Amazon EC2 Instance
HackerOneAWS VDP2024-12-24
Web, Cloud
High
XSS Reflected
HackerOneU.S. Dept Of Defense2024-12-18
Web
Medium
[ CVE-2018-1000129 ] RXSS At `https://███████` via the URI
HackerOneU.S. Dept Of Defense2024-12-18
Web
Medium
RXSS on ████ via configUrl parameter
HackerOneMars2024-11-26
Web
Low
Reflected HTML Injection via contact (faq) search parameter on ██████████
HackerOneMars2024-11-25
Web
Medium
Reflected HTML Injection via contact (faq) search parameter on ███]=
HackerOneMars2024-11-25
Web
Medium
RXSS on ████ via q parameter
HackerOneMars2024-11-21
Web
Low
Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/
HackerOneAcronis2024-11-20$100 bounty
Web
Low
RXSS in ███ via S parameter
HackerOneMars2024-11-19
Web
Medium
Reflected XSS on formaction parameter
HackerOneMars2024-11-19
Web
Medium
Potential XSS Vulnerability in Acronis Login Callback URL
HackerOneAcronis2024-11-06
Web
High
Potential XSS in redirect_url Parameter
HackerOneAcronis2024-11-06
Web
Medium
Stored XSS on trix editor version 2.1.1
HackerOneBasecamp2024-11-04$1,000 bounty
Web
High
Blind XSS on admin.acronis.com via delete account form on account.acronis.com
HackerOneAcronis2024-10-30
Web
High
Reflected - XSS
HackerOneMTN Group2024-10-21
Web
High
Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=
HackerOneMTN Group2024-10-05
Web
Critical
Stored-XSS-ads.tiktok.com
HackerOneTikTok2024-10-02
Web
Low
Showing the 150 most recent of 310. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.