Mars · Report #2684274
RXSS on ████ via configUrl parameter
Validstatus
lowseverity
53upvotes
26 Nov 2024disclosed
Summary
A Reflected Cross-Site Scripting (RXSS) vulnerability is reported on the Swagger UI page of the Royal Canin eVet API. The vulnerability is identified in the configUrl parameter of the URL █████████. This security flaw allows an attacker to inject malicious scripts into the web page, which are then executed in the context of other users' browsers when they visit the compromised page.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.