HexBrain

Mars · Report #2684274

RXSS on ████ via configUrl parameter

Validstatus
lowseverity
53upvotes
26 Nov 2024disclosed

Summary

A Reflected Cross-Site Scripting (RXSS) vulnerability is reported on the Swagger UI page of the Royal Canin eVet API. The vulnerability is identified in the configUrl parameter of the URL █████████. This security flaw allows an attacker to inject malicious scripts into the web page, which are then executed in the context of other users' browsers when they visit the compromised page.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original