Imgur · Report #169751
Stored XSS in albums on http://m.imgur.com/
Validstatus
5upvotes
17 Jan 2017disclosed
Summary
Special characters were not being escaped on the mobile web product properly. This allowed an attacker to set a description or title to an XSS payload which would then execute upon loading.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.