Veris · Report #137119
[XSS] sandbox.veris.in
Validstatus
5upvotes
9 Sept 2016disclosed
How it was found
Hello I want to report a XSS in ,,Badge Types''
Steps to reproduce :
- Create a badge with badge name "><img src=x onerror=alert(1)> badge description "><img src=x onerror=alert(1)> , select Organization press ,,Add New Badge Key '' in Key display name complete this with same payload "><img src=x onerror=alert(1)> , complete all requirements but in ,,Input type'' select Text only'' and Confirm badge Type.
- Press view badge and alert was executed
I make video if must