Mars · Report #2189797
RXSS on stores on *█████████/visitorRegistration.pml via destination parameter
Validstatus
mediumseverity
40upvotes
2 Sept 2025disclosed
Summary
The vulnerability involved a reflected XSS in the destination parameter of the visitorRegistration.pml endpoint across all stores under ██████████. The reporter provided a working proof of concept demonstrating JavaScript execution via URL parameter injection.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.