Shopify · Report #192140
XSS on postal codes
Validstatus
mediumseverity
15upvotes
11 Jan 2017disclosed
How it was found
Hi, #190951 is not fully fixed. Scripts can be injected via a csv file and make it execute in the application. Screenshots attached.