Slack · Report #258198
The Custom Emoji Page has a Reflected XSS
Validstatus
highseverity
56upvotes
24 Sept 2017disclosed
How it was found
The Custom Emoji Page has a Reflected XSS in building flash message.
The following is the PoC. https://{team}.slack.com/customize/emoji?added=1&name=vuln"><script>alert(0);<%2Fscript>