Mapbox · Report #158461
Blind XSS in mapbox.com/contact
Validstatus
$750bounty
17upvotes
15 Aug 2017disclosed
Summary
@sahilsaif reported a stored blind XSS issue on www.mapbox.com/contact. To fix the issue we escaped user provided message content before sending to our middleware server.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.