Stored XSS via ' profile ' at ███
Medium
Vulnerability Details
hi team
i found stored xss on profile
1. Go to registration page (██████)
2. Verified your account.
3. Go to login page and login your account.
For the fastly test, use this credentials to login (my test account)
█████████ For Attacker
email: █████████
pass: Password
████ For Victime
email: █████████
pass: password
After login i change animal name to payload xss .. i open victime account and i put attacker profile url so i succeeded.
██████████
## Impact
Stored Cross Site Scripting which attacker can execute malicious javascript payload.
Actions
View on HackerOneReport Stats
- Report ID: 1921606
- State: Closed
- Substate: resolved
- Upvotes: 15