Starbucks · Report #540399
Reflected XSS on card.starbucks.com.sg/unsub.php via the 'ct' Parameter
Validstatus
mediumseverity
7upvotes
12 Dec 2019disclosed
Summary
gnux discovered a reflected XSS in https://card.starbucks.com.sg/unsub.php due to an unsanitized user-input via the ct parameter.
@gnux— thank you for reporting this vulnerability and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.