Autodesk · Report #2978923
HTML Injection in Business Name Parameter in Payapps
Validstatus
mediumseverity
75upvotes
7 Apr 2025disclosed
Summary
A HTML injection vulnerability was found in Autodesk Payapps, which could have allowed an attacker to inject arbitrary HTML content in emails sent to users on signup. Autodesk has fixed the vulnerability and we thank @0xsom3a for reporting this issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.