Shopify · Report #190951

XSS on manually entering Postal codes

Validstatus

mediumseverity

$500bounty

21upvotes

17 Dec 2016disclosed

How it was found

Hello, I had found a XSS vulnerability in manually entering postal codes in "Advance Cash On Delivery" option which is newly launched for indians.Below is the screenshot attached. Thank You.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original