HexBrain

FetLife · Report #1085914

Stored XSS via `Create a Fetish` section.

Validstatus
mediumseverity
98upvotes
25 Feb 2021disclosed

Summary

The reporter pointed out that the fetish field for creating new fetishes on FetLife was vulnerable to a stored XSS exploit, after creating a fetish for which this exploit was used the contents would execute whenever people added the fetish to their profile and attempted to edit the fetish through their profile settings.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original