Khan Academy · Report #6369
Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudents
Validstatus
4upvotes
9 Apr 2014disclosed
How it was found
Hi,
when you go to https://www.khanacademy.org/coach/roster/?listId=allStudents and press on add class you have the possebility to add a class (obvious). when you name it "><img src=x onerror=alert(4)> it will stay persistent.
quite dangerous
Best regards,
Olivier Beg