Recorded Future · Report #1201134

[https://app.recordedfuture.com] - Reflected XSS via username parameter

Validstatus

mediumseverity

42upvotes

21 Jan 2022disclosed

How it was found

1-> Visit https://app.recordedfuture.com/live/login/?reset=x&username=xss%22%3E%3Cimg+src=x+onerror=alert(document.domain)%3E

An attacker could be able to Inject Malicious Javascript to compromise users

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original