ExpressionEngine · Report #411063
Persistent XSS via malicious license file
Validstatus
mediumseverity
9upvotes
28 Sept 2018disclosed
Summary
@unbaiat discovered that the display of the license file information was not properly sanitized leaving it vulnerable to XSS. @unbaiat gave a detailed report with step-by-step instructions for replicating, enabling a speedy resolution to the issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.