Moneybird · Report #211643
Stored Cross Site Scripting in Customer Name
Validstatus
lowseverity
13upvotes
17 Mar 2017disclosed
Summary
Researcher found a vulnerability in our contact selector, in which a contact name with HTML would trigger this HTML to be executed. We have improved our contact selector to handle customer names as text instead of HTML.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.