Content Spoofing via reports

How it was found

The report_id[] param simply returns whatever entered , instead of showing report id's only. This can result in content injection in the reports field. For example check this one : http://goo.gl/py2V8j