Moneybird · Report #130591
Stored XSS thru SVG upload
Validstatus
9upvotes
17 Mar 2017disclosed
Summary
Researcher found a way to add XSS code to SVG uploads in our software. We have improved our software by preventing SVG and HTML files to be presented in the webbrowser to prevent XSS attacks.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.