Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Sherlock bug bounty programs

sherlock.xyz Updated

Sherlock runs one public program: a Sherlock bug bounty paying up to $500,000.

Top reward
$500,000
Sherlock
Programs
1
1 pays cash
Targets in scope
1
1 type
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Sherlock runs.

  • Sherlock

    Sherlock · Bug bounty

    Open

    Top reward

    $500k
    Critical
    $500k
    High
    –
    Medium
    –
    Low
    –

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

1 target.

  • https://github.com/sherlock-protocol/sherlock-v2-core

    Source code

No target matches. Try part of a host name, such as the company name.

Recent changes

Reward and scope changes across every Sherlock program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Sherlock products, from the NVD.

Search NVD
  • CVE-2026-5035 Medium

    A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handler. Such manipulation of the argument en_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

  • CVE-2026-5034 Medium

    A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the component Parameter Handler. This manipulation of the argument cos_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

  • CVE-2026-5033 Medium

    A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php of the component Parameter Handler. The manipulation of the argument cos_id results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

  • CVE-2024-25212 High

    Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /delete.php.

  • CVE-2024-25213 High

    Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php.

  • CVE-2024-25214 Critical

    An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.

  • CVE-2024-25215 Critical

    Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php.

  • CVE-2024-25216 Critical

    Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php.

About this page

This page gathers every public program listed under sherlock.xyz: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.