Shopify · Report #755679
Timeline Editor Self-XSS (Previous Fix #738072 Incomplete)
Validstatus
lowseverity
$500bounty
35upvotes
16 Mar 2020disclosed
How it was found
1.Consistent steps
2.poc: <img src=1111111><img src=1111111><a href="javascript:alert(/1/)">axxx</a><svg></svg><img src=1>
3. {F656339}
Impact
admin