All private support requests to ███████ are being disclosed at https://███████

How it was found

Hello DoD Team Summary: I have found out that all personal requests made to https://█████ form are being disclosed to the public at https://███████, which posses a critical privacy issue.

Description: While searching my name at google "naglinagli" i have encountered a weird mention of my xss payload at the following endpoint https://██████████, which made realize that all the requests made at the contact form are open to the public

Step-by-step Reproduction Instructions

1. Navigate to https://███████
2. File a request.

█████████

3. Your request will publicly appear at https://█████

████

Suggested Mitigation/Remediation Actions

Making the access to the vulnerable endpoint to authorized personal only.

Best Regards,

nagli.

Impact

Personal reports made to █████ including PII of customers is being disclosed to the public through publicly accessible endpoint