HexBrain

Mavenlink · Report #63537

XSS in https://app.mavenlink.com/workspaces/

Validstatus
3upvotes
22 Jun 2015disclosed

How it was found

My name of mavelink account causes cross site scripting vulnerability

my name="><img src=x onerror=prompt(31);>

go to https://app.mavenlink.com/workspaces/8591867/gantt

and click "save snapshot" button than save it

When You save it you will get javascrip alert from "Can be viewed by ">" area beucae my mavelink name ("><img src=x onerror=prompt(31);>)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original