FormAssembly · Report #196989
XSS on username when register to proffesional account
Validstatus
lowseverity
5upvotes
26 Apr 2017disclosed
Summary
A XSS vulnerability was found in the username field of one of our sign-up pages (https://www.formassembly.com/partners/salesforce/sign-up.php?plan=PROFESSIONAL). The researcher was able to prompt an alert by posting this code in the field: "><img src=x onerror=alert(document.domain)>
This issue was corrected and we thank the researcher, @bogdantcaciuc for his contributions to our site's security.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.