TikTok · Report #1022655
HTML Injection on Company Name on Email
Validstatus
lowseverity
$79bounty
38upvotes
31 Dec 2020disclosed
Summary
By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.