TikTok · Report #1694037
Stored XSS in the ticketing system
Validstatus
mediumseverity
$1,000bounty
46upvotes
10 Oct 2022disclosed
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was found on a TikTok Seller endpoint, which could have resulted in a JavaScript payload injected into the endpoint causing it to be executed within the context of the victim's browser. We thank @codeslayer137 for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.