2000+ Top XSS Reports From HackerOne

Top XSS reports from HackerOne (2000+)
1. Bypass for #488147 enables stored XSS on https://paypal.com/signin again to PayPal - 2572 upvotes, $20000
2. Stored XSS on https://paypal.com/signin via cache poisoning to PayPal - 654 upvotes, $18900
3. Reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/ to Glassdoor - 636 upvotes, $0
4. Stored XSS in Wiki pages to GitLab - 599 upvotes, $0
5. Stored XSS on imgur profile to Imgur - 591 upvotes, $0
6. Reflected XSS in OAUTH2 login flow to LY Corporation - 472 upvotes, $1989
7. XSS in steam react chat client to Valve - 457 upvotes, $7500
8. Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration to TikTok - 452 upvotes, $0
9. XSS vulnerable parameter in a location hash to Slack - 442 upvotes, $0
10. One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on
www.redditmedia.com to Reddit - 441 upvotes, $10000
11. Blind XSS on image upload to CS Money - 415 upvotes, $1000
12. Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message to Valve - 408 upvotes, $0
13. Stored XSS Vulnerability to WordPress - 397 upvotes, $0
14. Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg to Uber - 371 upvotes, $4000
15. Reflected XSS on www.hackerone.com and resources.hackerone.com to HackerOne - 360 upvotes, $500
16. [accounts.reddit.com] Redirect parameter allows for XSS to Reddit - 352 upvotes, $5000
17. Stored XSS in wordpress.com to Automattic - 348 upvotes, $0
18. HEY.com email stored XSS to Basecamp - 347 upvotes, $5000
19. Reflected XSS in TikTok endpoints to TikTok - 346 upvotes, $0
20. Blind XSS on Twitter's internal Big Data panel at █████████████ to X (Formerly Twitter) - 344 upvotes, $0
21. Stored XSS in Private Message component (BuddyPress) to WordPress - 331 upvotes, $0
22. XSS while logging using Google to Shopify - 328 upvotes, $1750
23. DOM XSS on duckduckgo.com search to DuckDuckGo - 317 upvotes, $0
24. Stored XSS in my staff name fired in another your internal panel to Shopify - 317 upvotes, $0
25. Reflected XSS to Bumble - 314 upvotes, $1000
26. Reflected XSS at https://pay.gold.razer.com escalated to account takeover to Razer - 287 upvotes, $750
27. yelp.com XSS ATO (via login keylogger, link Google account) to Yelp - 286 upvotes, $0
28. Stored XSS in markdown via the DesignReferenceFilter to GitLab - 278 upvotes, $16000
29. Cross-site Scripting (XSS) - Stored in RDoc wiki pages to GitLab - 276 upvotes, $3500
30. Unrestricted file upload leads to Stored XSS to Visma Public - 268 upvotes, $250
31. Persistent XSS on keybase.io via "payload" field in /user/sigchain_signature.toffee template to Keybase - 265 upvotes, $0
32. Stored XSS via Kroki diagram to GitLab - 260 upvotes, $13950
33. Account takeover through the combination of cookie manipulation and XSS to Grammarly - 259 upvotes, $0
34. RichText parser vulnerability in scheduled posts allows XSS to Reddit - 252 upvotes, $5000
35. Arbitrary File Upload to Stored XSS to Visma Public - 245 upvotes, $250
36. Stored xss in address field in billing activity at https://shop.aaf.com/Order/step1/index.cfm to Alliance of American Football - 238 upvotes, $0
37. XSS and Open Redirect on MoPub Login to X (Formerly Twitter) - 231 upvotes, $1540
38. XSS via Direct Message deeplinks to X (Formerly Twitter) - 228 upvotes, $0
39. Cross-site Scripting (XSS) on HackerOne careers page to HackerOne - 224 upvotes, $500
40. Reflected XSS on www.hackerone.com via Wistia embed code to HackerOne - 224 upvotes, $500
41. Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF to New Relic - 224 upvotes, $0
42. XSS At "pages.et.uber.com" to Uber - 221 upvotes, $0
43. [panel.city-mobil.ru/admin/] Blind XSS into username to Mail.ru - 219 upvotes, $0
44. [www.zomato.com] Blind XSS on one of the Admin Dashboard to Zomato - 214 upvotes, $750
45. Stored XSS in developer.uber.com to Uber - 213 upvotes, $7500
46. Stored XSS on reports. to X (Formerly Twitter) - 213 upvotes, $700
47. XSS at jamfpro.shopifycloud.com to Shopify - 206 upvotes, $9400
48. Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into state to Grammarly - 205
upvotes, $3000
49. XSS via Mod Log Removed Posts to Reddit - 203 upvotes, $6000
50. Ability to create own account UUID leads to stored XSS to Upserve - 197 upvotes, $1500
51. XSS and cache poisoning via upload.twitter.com on ton.twitter.com to X (Formerly Twitter) - 195 upvotes, $0
52. Stored XSS on TikTok Ads to TikTok - 191 upvotes, $2500
53. DOM Based XSS in www.hackerone.com via PostMessage to HackerOne - 189 upvotes, $500
54. H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie Stuffing to Shopify - 188 upvotes, $0
55. Stored Xss Vulnerability on ████████ to U.S. Dept Of Defense - 187 upvotes, $0
56. XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker) to Rockstar Games - 187 upvotes, $0
57. Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash) to InnoGames - 186 upvotes,
$1100
58. XSS on Desktop Client to Keybase - 173 upvotes, $0
59. Stored XSS & SSRF in Lark Docs to Lark Technologies - 171 upvotes, $3000
60. Reflected Cross site Scripting (XSS) on www.starbucks.com to Starbucks - 167 upvotes, $0
61. XSS at https://exchangemarketplace.com/blogsearch to Shopify - 166 upvotes, $0
62. DOM Based XSS via postMessage at https://inventory.upserve.com/login/ to Upserve - 163 upvotes, $2500
63. Cross-account stored XSS at embedded charts to New Relic - 157 upvotes, $0
64. Stored-XSS with CSP-bypass via labels' color to GitLab - 156 upvotes, $0
65. XSS in gist integration to Slack - 154 upvotes, $500
66. xss on https://www.rockstargames.com/GTAOnline/jp/screens/ to Rockstar Games - 154 upvotes, $0
67. IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier to HackerOne - 148 upvotes, $2500
68. Stored XSS in notes (charts) because of insecure chart data JSON generation to New Relic - 146 upvotes, $0
69. Prototype Pollution leads to XSS on https://blog.swiftype.com/#proto[asd]=alert(document.domain) to Elastic - 144 upvotes, $2000
70. XSS in www.shopify.com/markets?utm_source= to Shopify - 144 upvotes, $700
71. Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP to
HackerOne - 143 upvotes, $1500
72. CSRF leads to a stored self xss to Imgur - 142 upvotes, $0
73. Stored XSS in IE11 on hackerone.com via custom fields to HackerOne - 141 upvotes, $0
74. XSS Reflected on reddit.com via url path to Reddit - 141 upvotes, $0
75. Reflected xss in https://sh.reddit.com to Reddit - 140 upvotes, $5000
76. XSS via message subject - mobile application to Mail.ru - 139 upvotes, $1000
77. Stored XSS in Notes (with CSP bypass for gitlab.com) to GitLab - 137 upvotes, $13950
78. XSS - main page - search[user_id] parameter to OLX - 136 upvotes, $0
79. XSS reflected on [https://www.pixiv.net] to pixiv - 135 upvotes, $500
80. Persistent XSS in Note objects to GitLab - 134 upvotes, $4500
81. Reflected XSS in twitterflightschool.com to X (Formerly Twitter) - 132 upvotes, $1120
82. Stored XSS on byddypress Plug-in via groups name to WordPress - 131 upvotes, $0
83. Stored XSS in 'Notes' to Visma Public - 130 upvotes, $250
84. Reflected XSS at https://www.paypal.com/ppcreditapply/da/us to PayPal - 130 upvotes, $0
85. Reflected/Stored XSS on duckduckgo.com to DuckDuckGo - 130 upvotes, $0
86. Stored XSS when uploading files to an invoice to Visma Public - 128 upvotes, $250
87. Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com to HackerOne - 123 upvotes, $0
88. Stored XSS in localhost:* via integrated torrent downloader to Brave Software - 122 upvotes, $0
89. Stored XSS in custom emoji to GitLab - 121 upvotes, $3000
90. XSS via referrer parameter to X (Formerly Twitter) - 121 upvotes, $0
91. Stored XSS in private message to Shopify - 120 upvotes, $1000
92. Stored XSS in Document Title to Localize - 120 upvotes, $50
93. [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameter to Uber - 119 upvotes, $3000
94. Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com to LinkedIn - 118 upvotes, $0
95. " 😂 " + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/ to Mail.ru - 117 upvotes, $0
96. web.icq.com XSS in chat message via contact info to Mail.ru - 116 upvotes, $0
97. Stored XSS in SVG file as data: url to Shopify - 115 upvotes, $5300
98. A reflected XSS in python/Lib/DocXMLRPCServer.py to Internet Bug Bounty - 115 upvotes, $0
99. Reflected XSS on https://inventory.upserve.com/ (affects IE users only) to Upserve - 114 upvotes, $0
100. Stored XSS vulnerability in comments on *.wordpress.com to Automattic - 114 upvotes, $0
101. Possible XSS vulnerability without a content security bypass to Stripe - 113 upvotes, $2000
102. Stored XSS in backup scanning plan name to Acronis - 113 upvotes, $500
103. XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog" to Shopify -
112 upvotes, $3000
104. Stored XSS in Snapmatic + R★Editor comments to Rockstar Games - 112 upvotes, $0
105. Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/ to TikTok - 112 upvotes, $0
106. Reflected XSS on https://www.uber.com to Uber - 111 upvotes, $0
107. XSS via JavaScript evaluation of an attacker controlled resource at www.pornhub.com to Pornhub - 109 upvotes, $250
108. Reflected xss on ads.tiktok.com using from parameter. to TikTok - 109 upvotes, $0
109. Insecure file upload in xiaoai.mi.com Lead to Stored XSS to Xiaomi - 107 upvotes, $0
110. Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget to HackerOne - 105 upvotes, $500
111. XSS: Group search terms to Vanilla - 105 upvotes, $0
112. Web Cache Poisoning leads to Stored XSS to Glassdoor - 105 upvotes, $0
113. DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) to HackerOne - 104 upvotes, $0
114. Stored XSS on any page in most Uber domains to Uber - 103 upvotes, $6000
115. Reflected XSS in VPN Appliance to New Relic - 103 upvotes, $0
116. DOM XSS at https://www.thx.com in IE/Edge browser to Razer - 102 upvotes, $250
117. XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExact to Glassdoor - 102 upvotes, $0
118. Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs to Slack - 101 upvotes,
$1000
119. Stored XSS in Shopify Chat to Shopify - 101 upvotes, $500
120. XSS in SocialIcon Link to Linktree - 100 upvotes, $0
121. DOM XSS on ads.tiktok.com to TikTok - 99 upvotes, $2500
122. XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction) to PayPal - 98 upvotes, $0
123. Reflected XSS in *.myshopify.com/account/register to Shopify - 97 upvotes, $1500
124. [www.zomato.com] Blind XSS in one of the admin dashboard to Zomato - 97 upvotes, $500
125. RXSS to Stored XSS - forums.pubg.com | URL parameter to PUBG - 97 upvotes, $0
126. Reflected XSS on https://make.wordpress.org via 'channel' parameter to WordPress - 95 upvotes, $0
127. Stored XSS via Create a Fetish section. to FetLife - 94 upvotes, $0
128. Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid} to HackerOne - 94 upvotes, $0
129. XSS in request approvals to GitLab - 93 upvotes, $3000
130. Stored XSS on TikTok Live Form to TikTok - 93 upvotes, $1500
131. Reflected XSS in pubg.com to PUBG - 93 upvotes, $0
132. DOM XSS at www.forescout.com in Microsoft Edge and IE Browser to ForeScout Technologies - 93 upvotes, $0
133. Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media to Automattic - 93 upvotes, $0
134. DOM-based XSS on mobile.line.me to LY Corporation - 92 upvotes, $0
135. XSS in Email Input [intensedebate.com] to Automattic - 92 upvotes, $0
136. Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive data to X (Formerly Twitter) - 92
upvotes, $0
137. Bypass: Stored-XSS with CSP-bypass via scoped labels' color to GitLab - 92 upvotes, $0
138. Reflected XSS online-store-git.shopifycloud.com to Shopify - 91 upvotes, $3500
139. CSTI at Plugin page leading to active stored XSS (Publisher name) to New Relic - 91 upvotes, $0
140. CSP-bypass XSS in project settings page to GitLab - 91 upvotes, $0
141. DOM-Based XSS in tumblr.com to Automattic - 90 upvotes, $0
142. Stored xss at https://█.8x8.com/api/█/ID to 8x8 Bounty - 90 upvotes, $0
143. Stored XSS in vanilla to Vanilla - 89 upvotes, $300
144. Stored XSS to Mail.ru - 89 upvotes, $0
145. Stored XSS in vanilla to Vanilla - 88 upvotes, $300
146. DOM based XSS on *.██████.com via document.domain sink in Safari to ██████ - 87 upvotes, $0
147. Stored XSS in "Create Groups" to GitLab - 86 upvotes, $2500
148. capsula.mail.ru - Admin blind stored XSS to Mail.ru - 86 upvotes, $1500
149. Reflected XSS on transact.playstation.com using postMessage from the opening window to PlayStation - 86 upvotes, $1000
150. Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover) to Expedia Group Bug Bounty - 86 upvotes, $750
151. CRLF injection leads to internal XSS on PangleGlobal to TikTok - 86 upvotes, $0
152. Reflected XSS on TikTok Website to TikTok - 85 upvotes, $3000
153. Stored XSS via malicious key value of Synthetics monitor tag when visiting an Insights dashboard with filtering enabled to New Relic - 85
upvotes, $2123
154. CRLF to XSS & Open Redirection to TikTok - 85 upvotes, $0
155. xss to Pornhub - 84 upvotes, $0
156. Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swf to Acronis - 84 upvotes, $0
157. Reflected XSS in https://light.mail.ru/login via page to Mail.ru - 83 upvotes, $0
158. Blind XSS in operator's interface for 33slona.ru to Mail.ru - 83 upvotes, $0
159. Persistent DOM-based XSS in https://help.twitter.com via localStorage to X (Formerly Twitter) - 82 upvotes, $0
160. Unrestricted file upload leads to Stored XSS to GitLab - 82 upvotes, $0
161. XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications to Shopify - 81
upvotes, $5000
162. [pay.gold.razer.com] Stored XSS - Order payment to Razer - 81 upvotes, $1500
163. Html Injection and Possible XSS in sms-be-vip.twitter.com to X (Formerly Twitter) - 81 upvotes, $0
164. DOMXSS in redirect param to Semmle - 81 upvotes, $0
165. Potential unprivileged Stored XSS through wp_targeted_link_rel to WordPress - 80 upvotes, $0
166. Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.asp to Acronis - 80 upvotes, $0
167. Reflected XSS в /video to VK.com - 79 upvotes, $500
168. Reflect XSS on Mobile Search page to Pornhub - 79 upvotes, $250
169. Urgent! Stored XSS at plugin's violations leading to account takeover to New Relic - 79 upvotes, $0
170. New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields to GitLab - 78
upvotes, $13950
171. Defacement of catalog.data.gov via web cache poisoning to stored DOMXSS to GSA Bounty - 77 upvotes, $750
172. Stored XSS in Email Templates via link to Judge.me - 77 upvotes, $500
173. stored XSS in hey.com message content to Basecamp - 77 upvotes, $0
174. Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com) to HackerOne - 77 upvotes, $0
175. Stored XSS via Angular Expression injection via Subject while starting conversation with other users. to FetLife - 77 upvotes, $0
176. Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name" to GitLab - 76 upvotes, $3000
177. ██████ DOM XSS via Shopify.API.remoteRedirect to Shopify - 76 upvotes, $0
178. XSS Payload on TikTok Seller Center endpoint to TikTok - 75 upvotes, $1000
179. Stored XSS in email to Mail.ru - 75 upvotes, $0
180. Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass to Automattic - 75 upvotes, $0
181. [https://city-mobil.ru/taxiserv] Blind XSS into username to Mail.ru - 74 upvotes, $0
183. XSS from arbitrary attachment upload. to Qulture.Rocks - 74 upvotes, $0
184. Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php to Automattic - 74 upvotes, $0
185. Stored XSS in Discounts section to Shopify - 73 upvotes, $1000
186. XSS via POST request to https://account.mail.ru/signup/ to Mail.ru - 73 upvotes, $1000
187. Passive stored XSS at broadcast room to Chaturbate - 73 upvotes, $0
188. xss stored to Shopify - 73 upvotes, $0
189. Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field to TikTok - 73 upvotes, $0
190. XSS in ZenTao integration affecting self hosted instances without strict CSP to GitLab - 72 upvotes, $13950
191. Reflective Cross-site Scripting via Newsletter Form to Shopify - 72 upvotes, $2000
192. Blind XSS in redtube administering site my.reflected.net to Pornhub - 72 upvotes, $1000
193. Reflected XSS in https://www.starbucks.co.jp/store/search/ to Starbucks - 72 upvotes, $0
194. Reflected cross-site scripting on multiple Starbucks assets. to Starbucks - 72 upvotes, $0
195. XSS on tiktok.com to TikTok - 72 upvotes, $0
196. XSS via Cookie in Mail.ru to Mail.ru - 71 upvotes, $1000
197. Reflected XSS on www.pornhub.com and www.pornhubpremium.com to Pornhub - 71 upvotes, $750
198. Multiple XSS on account settings that can hijack any users in the company. to X (Formerly Twitter) - 71 upvotes, $700
199. RCE, SQLi, IDOR, Auth Bypass and XSS at [staff.███.edu.eg ] to ██████ - 71 upvotes, $0
200. Stored XSS that allow an attacker to read victim mailboxes contacts in mail.ru and my.com application to Mail.ru - 71 upvotes, $0
201. XSS on https://partners.acronis.com/ to Acronis - 71 upvotes, $0
202. Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage to LocalTapiola - 70 upvotes, $5000
203. [account.mail.ru] XSS-уязвимость в форме авторизации to Mail.ru - 70 upvotes, $1000
204. New XSS vector in ReaderMode with %READER-TITLE-NONCE% to Brave Software - 69 upvotes, $1000
205. Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage to LocalTapiola - 69 upvotes, $0
206. Reflected XSS in <any>.myshopify.com through theme preview to Shopify - 69 upvotes, $0
207. help.shopify.com Cross Site Scripting to Shopify - 69 upvotes, $0
208. Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv to Vimeo - 69 upvotes,
$0
209. stripo.email reflected xss to Stripo Inc - 69 upvotes, $0
210. Potential stored Cross-Site Scripting vulnerability in Support Backend to HackerOne - 69 upvotes, $0
211. Reflected XSS & Open Redirect at mcs main domain to Mail.ru - 68 upvotes, $0
212. [dev.twitter.com] XSS and Open Redirect to X (Formerly Twitter) - 67 upvotes, $1120
213. reflected xss in e.mail.ru to Mail.ru - 67 upvotes, $1000
214. Reflected XSS on secure.chaturbate.com to Chaturbate - 67 upvotes, $800
215. POST-based XSS on apps.shopify.com to Shopify - 67 upvotes, $500
216. WordPress Flash XSS in flashmediaelement.swf to Automattic - 67 upvotes, $0
217. Stored XSS в личных сообщениях to VK.com - 67 upvotes, $0
218. Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://your-subdomain.survey.fm to Automattic - 67
upvotes, $0
219. XSS on Videos IA to DuckDuckGo - 67 upvotes, $0
220. Stored XSS through PDF viewer to Slack - 66 upvotes, $4875
221. Cross-site Scripting (XSS) - DOM on https://account.mail.ru/user/garage?back_url=https://mail.ru to Mail.ru - 66 upvotes, $1000
222. Multiple DOMXSS on Amplify Web Player to X (Formerly Twitter) - 66 upvotes, $0
223. Possible DOM XSS on app.hey.com to Basecamp - 66 upvotes, $0
224. xss is triggered on your web to Shopify - 66 upvotes, $0
225. web.icq.com XSS in chat message via contact info to Mail.ru - 65 upvotes, $0
226. URL Advisor component in KIS products family is vulnerable to Universal XSS to Kaspersky - 65 upvotes, $0
227. Stored XSS through Facebook Page Connection to Shopify - 65 upvotes, $0
228. Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages to Starbucks - 65 upvotes, $0
229. DOM XSS triggered in secure support desk to QIWI - 65 upvotes, $0
230. XSS in linktr.ee - on link thumbnail adding to Linktree - 64 upvotes, $600
231. XSS on rockstargames.com to Rockstar Games - 64 upvotes, $500
232. xss in https://www.uber.com to Uber - 64 upvotes, $0
233. Cross Site Scripting using Email parameter in Ads endpoint 1 to TikTok - 64 upvotes, $0
234. Reflected XSS on www.grouplogic.com/video.asp to Acronis - 64 upvotes, $0
235. Stored Cross-site Scripting on devicelock.com/forum/ to Acronis - 64 upvotes, $0
236. Stored XSS in /admin/product and /admin/collections to Shopify - 63 upvotes, $5300
237. Reflected XSS and Server Side Template Injection in all HubSpot CMSes to HubSpot - 63 upvotes, $0
238. Stored XSS in Post title (PoC) to Imgur - 63 upvotes, $0
239. Wormable stored XSS in www.evernote.com to Evernote - 62 upvotes, $0
240. Stored XSS | api.mapbox.com | IE 11 | Styles name to Mapbox - 62 upvotes, $0
241. Stored XSS in [https://streamlabs.com/dashboard#/*goal] pages to Logitech - 62 upvotes, $0
242. Authenticated path traversal to Stored XSS and Denial-of-Service to phpBB - 62 upvotes, $0
243. Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/**** to Shopify - 61 upvotes, $2900
244. Stored XSS in Acronis Cyber Protect Console to Acronis - 61 upvotes, $500
245. Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent) to X (Formerly Twitter) - 61 upvotes, $0
246. [http_server] Stored XSS in the filename when directories listing to Node.js third-party modules - 61 upvotes, $0
247. Cross site scripting via file upload in subdomain ads.tiktok.com to TikTok - 60 upvotes, $500
248. DOM based CSS Injection on grammarly.com to Grammarly - 60 upvotes, $250
249. [www.zomato.com] Blind XSS in one of the Admin Dashboard to Zomato - 60 upvotes, $0
250. reflected XSS on panther.com to Panther Labs - 60 upvotes, $0
251. Reflected XSS on $Any$.myshopify.com/admin to Shopify - 58 upvotes, $1500
252. XSS via X-Forwarded-Host header to Omise - 58 upvotes, $200
253. Stored XSS on https://events.hackerone.com to HackerOne - 58 upvotes, $0
254. [web.icq.com] Stored XSS in Account Name to Mail.ru - 57 upvotes, $1000
255. Unrestricted file upload when creating quotes allows for Stored XSS to Visma Public - 57 upvotes, $250
256. Persistent Cross-Site Scripting in default Laravel installation to Laravel - 57 upvotes, $0
257. Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/upload to Starbucks - 57 upvotes, $0
258. Stored-XSS on wiki pages to GitLab - 57 upvotes, $0
259. XSS Reflected at https://sketch.pixiv.net/ Via next_url to pixiv - 56 upvotes, $500
260. XSS from Mastodon embeds to IRCCloud - 56 upvotes, $500
261. WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass) to
Starbucks - 56 upvotes, $0
262. Stored XSS on upload files leads to steal cookie to Palo Alto Software - 56 upvotes, $0
263. DOM-Based XSS in tumblr.com to Automattic - 56 upvotes, $0
264. Web Cache Poisoning leads to XSS and DoS to Glassdoor - 56 upvotes, $0
265. Stored XSS on wordpress.com to Automattic - 56 upvotes, $0
266. Stored XSS on activity to Shopify - 55 upvotes, $2000
267. Reflected XSS at http://promotion.molthailand.com/index.php via promotion_id parameter to Razer - 55 upvotes, $250
268. The Custom Emoji Page has a Reflected XSS to Slack - 55 upvotes, $0
269. XSS at TikTok Ads Endpoint to TikTok - 55 upvotes, $0
270. XSS account.mail.ru to Mail.ru - 54 upvotes, $1000
271. HTML Injection with XSS possible to Imgur - 54 upvotes, $0
272. Reflected XSS on https://www.glassdoor.com/job-listing/spotlight to Glassdoor - 54 upvotes, $0
273. Self XSS to Shopify - 53 upvotes, $500
274. [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name to Uber - 53 upvotes, $0
275. Unrestricted File Upload Results in Cross-Site Scripting Attacks to Uber - 53 upvotes, $0
276. Blind XSS via Feedback form. to Judge.me - 53 upvotes, $0
277. Reflected XSS Via origCity Parameter (UPPER Case + WAF Protection Bypass) to Expedia Group Bug Bounty - 52 upvotes, $300
278. Stored XSS in Intense Debate comment system to Automattic - 52 upvotes, $0
279. CVE-2023-29489 XSS in cpanel at [www.███] - Securado, Oman to U.S. Dept Of Defense - 52 upvotes, $0
280. Reflected XSS on marketsandresearch.td.com to TD Bank - 51 upvotes, $0
281. Stored XSS via Mermaid Prototype Pollution vulnerability to GitLab - 50 upvotes, $3000
282. DOMXSS in Tweetdeck to X (Formerly Twitter) - 50 upvotes, $0
283. Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/ to PayPal - 50 upvotes, $0
284. XSS and HTML Injection on the pressable.com search box to Automattic - 50 upvotes, $0
285. CSRF + XSS REFLECT to Daimler Truck - 50 upvotes, $0
286. Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains to Uber
- 49 upvotes, $6000
287. Stored XSS in photos_user_map.gne to Flickr - 49 upvotes, $3263
288. Stored XSS on the job page to GitLab - 49 upvotes, $3000
289. Stored XSS on support.rockstargames.com to Rockstar Games - 49 upvotes, $1000
290. Stored xss to Shopify - 49 upvotes, $1000
291. XSS в сюжетах. to VK.com - 49 upvotes, $500
292. XSS through __e2e_action_id delivered by JSONP to Quora - 49 upvotes, $0
293. Reflected XSS in m.imgur.com to Imgur - 49 upvotes, $0
294. (Prerelease UI) Stored XSS via role name in JSON chart to New Relic - 48 upvotes, $2500
295. OX (Guard): Stored Cross-Site Scripting via Incoming Email to Open-Xchange - 48 upvotes, $1000
296. [careers.informatica.com] Reflected Cross Site Scripting to XSS Shell Possible to Informatica - 48 upvotes, $0
297. XSS within Shopify Email App - Admin to Shopify - 48 upvotes, $0
298. Stored XSS in collabora via user name to Nextcloud - 48 upvotes, $0
299. XSS Reflected in m.vk.com to VK.com - 48 upvotes, $0
300. XSS on Issue reference numbers to GitLab - 48 upvotes, $0
301. Stored XSS at https://linkpop.com to Shopify - 48 upvotes, $0
302. Stored XSS in markdown when redacting references to GitLab - 47 upvotes, $5000
303. [my.games, lootdog.io] XSS via MCS Bucket to Mail.ru - 47 upvotes, $1333
304. Email templates XSS by filterXSS bypass to Judge.me - 47 upvotes, $1250
305. XSS in Desktop Client in the notifications to Nextcloud - 47 upvotes, $750
306. Stored XSS on store.my.games to Mail.ru - 47 upvotes, $200
307. Cross Site Scripting(XSS) on IRCCloud Badges Page (using Parameter Pollution) to IRCCloud - 47 upvotes, $0
308. [Android] XSS via start ContentActivity to Quora - 47 upvotes, $0
309. csp bypass + xss to X (Formerly Twitter) - 47 upvotes, $0
310. Reflected XSS to Shopify - 47 upvotes, $0
311. Stored XSS in wordpress.com to Automattic - 47 upvotes, $0
312. Reflected xss and open redirect on larksuite.com using /?back_uri= parameter. to Lark Technologies - 47 upvotes, $0
313. Stored XSS in merge request pages to GitLab - 46 upvotes, $3500
314. Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover to Uber - 46 upvotes, $3000
315. XSS on link and window.opener to Slack - 46 upvotes, $1000
316. [auth2.zomato.com] Reflected XSS at oauth2/fallbacks/error | ORY Hydra an OAuth 2.0 and OpenID Connect Provider to Zomato - 46 upvotes,
$0
317. Blind XSS via Suspended Ticket Recovery to Zendesk - 46 upvotes, $0
318. Reflected XSS through multiple inputs in the issue collector on Jira to Roblox - 46 upvotes, $0
319. Cross-site scripting on api.collabs.shopify.com to Shopify - 45 upvotes, $1600
320. xss stored in https://your store.myshopify.com/admin/ to Shopify - 45 upvotes, $1000
321. Blind stored xss [parcel.grab.com] > name parameter to Grab - 45 upvotes, $750
322. H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps to Shopify - 45 upvotes, $500
323. Cross-site scripting (reflected) to X (Formerly Twitter) - 45 upvotes, $0
324. XSS in HTML Content Generated by Flash Slideshow Maker (All Versions) to Socusoft - 45 upvotes, $0
325. Reflected XSS in https://lite.pubg.com to PUBG - 45 upvotes, $0
326. DOM based XSS on /GTAOnline/tw/starterpack/ to Rockstar Games - 45 upvotes, $0
327. [dev.twitter.com] XSS and Open Redirect Protection Bypass to X (Formerly Twitter) - 44 upvotes, $1120
328. Stored XSS when you read eamils. <style> to Mail.ru - 44 upvotes, $1000
329. Stored XSS in photo comment functionality to Pornhub - 44 upvotes, $0
330. Reflected XSS in https://blocked.myndr.net to Myndr - 44 upvotes, $0
331. DOM XSS on https://www.rockstargames.com/GTAOnline/feedback to Rockstar Games - 44 upvotes, $0
332. XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com to Shopify - 44 upvotes, $0
333. Cross-site Scripting (XSS) - Stored to Mail.ru - 44 upvotes, $0
334. Stored XSS via Mermaid Prototype Pollution vulnerability to GitLab - 43 upvotes, $3000
335. Stored XSS in the ticketing system to TikTok - 43 upvotes, $1000
336. Stored XSS in profile page to Acronis - 43 upvotes, $50
337. Store XSS to Slack - 43 upvotes, $0
338. Reflected XSS on https://help.glassdoor.com/GD_HC_EmbeddedChatVF to Glassdoor - 43 upvotes, $0
339. XSS vulnerability without a content security bypass in a CUSTOM App through Button tag to Stripe - 42 upvotes, $2000
340. [e.mail.ru] XSS в поиске to Mail.ru - 42 upvotes, $750
341. XSS on services.shopify.com to Shopify - 42 upvotes, $500
342. Stored XSS in [https://dashboard.doppler.com/workplace/*/logs] pages to Doppler - 42 upvotes, $0
343. [intensedebate.com] XSS Reflected POST-Based to Automattic - 42 upvotes, $0
344. DOM XSS on https://biz.mail.ru/domains/goto/mail/ via parameter pollution to Mail.ru - 42 upvotes, $0
345. Stored XSS in Mermaid when viewing Markdown files to GitLab - 42 upvotes, $0
346. wp-embed XSS on Safari to WordPress - 42 upvotes, $0
347. Stored XSS in profile activity feed messages to Rockstar Games - 41 upvotes, $1000
348. IE 11 Self-XSS on Jira Integration Preview Base Link to HackerOne - 41 upvotes, $750
349. Stored XSS Payload when sending videos to TikTok - 41 upvotes, $500
350. Stored xss to Algolia - 41 upvotes, $100
351. (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation to HackerOne - 41 upvotes, $0
352. Stored XSS in blog comments through Shopify API to Shopify - 41 upvotes, $0
353. [IRCCloud Android] XSS in ImageViewerActivity to IRCCloud - 41 upvotes, $0
354. Stored XSS in Jetpack's Simple Payment Module by Contributors / Authors to Automattic - 41 upvotes, $0
355. Blind XSS Stored On Admin Panel Through Name Parameter In [ https://technoatom.mail.ru/] to Mail.ru - 41 upvotes, $0
356. Reflected xss on 8x8.com subdomain to 8x8 - 41 upvotes, $0
357. Reflected Cross site Scripting (XSS) on https://one.newrelic.com to New Relic - 41 upvotes, $0
358. XSS vulnerabilities due to missing checks in tag helpers to Ruby on Rails - 41 upvotes, $0
359. Stored xss on message reply to Mail.ru - 40 upvotes, $500
360. XSS в личных сообщениях to ok.ru - 40 upvotes, $0
361. DOM Based XSS in mycrypto.com to MyCrypto - 40 upvotes, $0
362. Stored XSS (client-side, using cookie poisoning) on the pornhubpremium.com to Pornhub - 40 upvotes, $0
363. Очень жесткая XSS в личных сообщениях m.ok.ru to ok.ru - 40 upvotes, $0
364. WooCommerce: Persistent XSS via customer address (state/county) to Automattic - 40 upvotes, $0
365. Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters
to Starbucks - 40 upvotes, $0
366. Moodle XSS on evolve.glovoapp.com to Glovo - 40 upvotes, $0
367. Self XSS in Create New Workspace Screen to Mattermost - 40 upvotes, $0
368. XSS and iframe injection on tiktok ads portal using redirect params to TikTok - 40 upvotes, $0
369. Stored XSS in Brower name field reflected in two pages to New Relic - 39 upvotes, $3000
370. Blind XSS - Report review - Admin panel to Zomato - 39 upvotes, $350
371. [https://app.recordedfuture.com] - Reflected XSS via username parameter to Recorded Future - 39 upvotes, $300
372. Stored XSS in '' Section and WAF Bypass to Semrush - 39 upvotes, $0
373. Cross Site Scripting via CVE-2018-5230 on https://apps.topcoder.com to Topcoder - 39 upvotes, $0
374. XSS: v-safe-html is not safe enough to GitLab - 39 upvotes, $0
375. reflected XSS in [www.equifax.com] to Equifax-vdp - 39 upvotes, $0
376. XSS on about:tbupdate to Tor - 39 upvotes, $0
377. Reflected XSS on multiple uberinternal.com domains to Uber - 38 upvotes, $2000
378. XSS в upload.php to VK.com - 38 upvotes, $1500
379. Mattermost Server OAuth Flow Cross-Site Scripting to Mattermost - 38 upvotes, $900
380. Stored XSS on buy button to Shopify - 38 upvotes, $500
381. Reflected Xss On https://vk.com/search to VK.com - 38 upvotes, $500
382. XSS through chat messages to Vanilla - 38 upvotes, $300
383. Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/ to Acronis - 38 upvotes, $50
384. HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attribute to GSA Bounty - 38 upvotes, $0
385. CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS to Chaturbate - 38 upvotes, $0
386. Reflected XSS in lert.uber.com to Uber - 38 upvotes, $0
387. CSTI on https://www.ecobee.com leads to XSS to ecobee - 38 upvotes, $0
388. XSS on https://app.mopub.com/reports/custom/add/ [new-d1] to X (Formerly Twitter) - 38 upvotes, $0
389. Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.com to IBM - 38 upvotes, $0
390. Reflected XSS on https://www.uber.com to Uber - 37 upvotes, $1000
391. CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php' to Rockstar Games -
37 upvotes, $0
392. Stored XSS on www.starbucks.com.sg/careers/career-center/career-landing-* to Starbucks - 37 upvotes, $0
393. DOM based XSS in the WooCommerce plugin to Automattic - 37 upvotes, $0
394. Stored XSS on demo app link to Shopify - 37 upvotes, $0
395. [qiwi.me] Stored XSS to QIWI - 37 upvotes, $0
396. Cross-Site Scripting through search form on mtnplay.co.zm to MTN Group - 37 upvotes, $0
397. dom based xss on [hello.merchant.razer.com] to Razer - 36 upvotes, $500
398. Self XSS on Acronis Cyber Cloud to Acronis - 36 upvotes, $100
399. (BYPASS) Open redirect and XSS in supporthiring.shopify.com to Shopify - 36 upvotes, $0
400. Stored XSS on the https://www.redtube.com/users/[profile]/collections to Pornhub - 36 upvotes, $0
401. Хранимый XSS в Business-аккаунте, на странице компании to DRIVE.NET, Inc. - 36 upvotes, $0
402. Reflected xss в m.vk.com/chatjoin to VK.com - 36 upvotes, $0
403. reflected xss in https://wordpress.com/start/account/user to Automattic - 36 upvotes, $0
404. Blind Stored XSS Via Staff Name to Shopify - 35 upvotes, $3000
405. Rails ActionView sanitize helper bypass leading to XSS using SVG tag. to Internet Bug Bounty - 35 upvotes, $2400
406. [stored xss, pornhub.com] stream post function to Pornhub - 35 upvotes, $1500
407. XSS on product comments in transfers to Shopify - 35 upvotes, $500
408. www.starbucks.co.uk Reflected XSS via utm_source parameter to Starbucks - 35 upvotes, $0
409. Persistent XSS in www.starbucks.com to Starbucks - 35 upvotes, $0
410. Stored XSS in [shop].myshopify.com/admin/orders/[id] to Shopify - 35 upvotes, $0
411. Reflected XSS - gratipay.com to Gratipay - 35 upvotes, $0
412. Persistent XSS in https://sandbox.reverb.com/item/ to Reverb.com - 35 upvotes, $0
413. Stored XSS in galleries - https://www.redtube.com/gallery/[id] path to Pornhub - 35 upvotes, $0
414. Multiple stored XSS in WordPress to WordPress - 35 upvotes, $0
415. Reflected XSS on https://www.olx.co.id/iklan/*.html via "ad_type" parameter to OLX - 35 upvotes, $0
416. CSS Injection to disable app & potential message exfil to Slack - 35 upvotes, $0
417. Stored XSS in blob viewer to GitLab - 35 upvotes, $0
418. Store-XSS in error message of build-dependencies to GitLab - 35 upvotes, $0
419. Account takeover via XSS to Rocket.Chat - 35 upvotes, $0
420. Reflected XSS in photogallery component on [https://market.av.ru] to Azbuka Vkusa - 35 upvotes, $0
421. One Click XSS in [www.shopify.com] to Shopify - 35 upvotes, $0
422. Stored XSS on developer.uber.com via admin account compromise to Uber - 34 upvotes, $5000
423. DOM XSS via Shopify.API.Modal.initialize to Shopify - 34 upvotes, $500
424. Timeline Editor Self-XSS (Previous Fix #738072 Incomplete) to Shopify - 34 upvotes, $500
425. Cookie exfiltration through XSS on the main search request of www.lahitapiola.fi to LocalTapiola - 34 upvotes, $500
426. XSS *.myshopify.com/collections/vendors?q= to Shopify - 34 upvotes, $0
427. XSS found on Snapchat website to Snapchat - 34 upvotes, $0
428. Stored XSS in the guide's GameplayVersion (www.dota2.com) to Valve - 34 upvotes, $0
429. [allods.mail.ru] - WebCache Poisoning Host Header lead to Potential Stored XSS to Mail.ru - 34 upvotes, $0
430. XSS in biz.mail.ru/error to Mail.ru - 33 upvotes, $500
431. Stored XSS to Open-Xchange - 33 upvotes, $500
432. XSS in IE11 on portswigger.net via Flash to PortSwigger Web Security - 33 upvotes, $0
433. Stored XSS Deleting Menu Links in the Shopify Admin to Shopify - 33 upvotes, $0
434. DOM Based xss on https://www.rockstargames.com/ ( 1 ) to Rockstar Games - 33 upvotes, $0
435. Reflected XSS at https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true via PATH to Glassdoor - 33
upvotes, $0
436. POST BASED REFLECTED XSS IN dailydeals.mtn.co.za to MTN Group - 33 upvotes, $0
437. Bypass Filter and get Stored Xss to Shopify - 32 upvotes, $3000
438. Stored XSS on issue comments and other pages which contain notes to GitLab - 32 upvotes, $3000
439. Cross-site scripting on algorithm collaborator to Quantopian - 32 upvotes, $2100
440. DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ] to Uber - 32 upvotes, $1420
441. Stored XSS при удалении группы из беседы (m.vk.com) to VK.com - 32 upvotes, $500
442. XSS For Profile Name to Vanilla - 32 upvotes, $300
443. BlIND XSS on https://open.vanillaforums.com to Vanilla - 32 upvotes, $300
444. Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakage to Acronis - 32 upvotes, $150
445. Cross site scripting - XSRF Token to Nextcloud - 32 upvotes, $0
446. Blind Stored XSS Payload fired at the backend on https://█████████/ to U.S. Dept Of Defense - 32 upvotes, $0
447. [XSS] Reflected XSS via POST request in (editJobAlert.htm) file to Glassdoor - 32 upvotes, $0
448. Stored-XSS in merge requests to GitLab - 32 upvotes, $0
449. Bypassing Content-Security-Policy leads to open-redirect and iframe xss to Stripo Inc - 32 upvotes, $0
450. Reflected XSS on delivery.glovoapp.com to Glovo - 32 upvotes, $0
451. Clipboard DOM-based XSS to GitLab - 32 upvotes, $0
452. Reflected XSS on Partners Subdomain to Uber - 31 upvotes, $2000
453. [Java] CWE-079: Query to detect XSS with JavaServer Faces (JSF) to GitHub Security Lab - 31 upvotes, $1800
454. XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious app to Shopify -
31 upvotes, $1000
455. XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter to Shopify - 31 upvotes, $1000
456. XSS in message e.mail.ru to Mail.ru - 31 upvotes, $1000
457. Stored XSS in chat topic due to insecure emoticon parsing on any message type to Chaturbate - 31 upvotes, $450
458. Cookie based XSS on http://ftp1.thx.com to Razer - 31 upvotes, $375
459. Reflected XSS on partners.cloudflare.com to Cloudflare Vulnerability Disclosure - 31 upvotes, $0
460. XSS risk reduction with X-XSS-Protection: 1; mode=block header to Radancy - 31 upvotes, $0
461. XSS https://agent.postamat.tech/ в профиле + дисклоз секретной информации to QIWI - 31 upvotes, $0
462. XSS leads to RCE on the RocketChat desktop client. to Rocket.Chat - 31 upvotes, $0
463. Reflected Cross-Site scripting in : mtn.bj to MTN Group - 31 upvotes, $0
464. Xss At Shopify Email App to Shopify - 31 upvotes, $0
465. SSRF & Blind XSS in Gravatar email to Automattic - 31 upvotes, $0
466. DOM XSS at https://adobedocs.github.io/OAE_PartnerAPI/?configUrl={site} due to outdated Swagger UI to Adobe - 31 upvotes, $0
467. Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You Header to Automattic - 31 upvotes, $0
468. XSS in Cisco Endpoint to U.S. Dept Of Defense - 31 upvotes, $0
469. Reflected XSS on developer.uber.com via Angular template injection to Uber - 30 upvotes, $3000
470. Reflected XSS POST method at partners.uber.com to Uber - 30 upvotes, $3000
471. Xss was found by exploiting the URL markdown on http://store.steampowered.com to Valve - 30 upvotes, $1000
472. Self-Stored XSS - Chained with login/logout CSRF to Zomato - 30 upvotes, $300
473. Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com to TikTok - 30 upvotes, $250
474. Cross-site scripting in "Contact customer" form to Shopify - 30 upvotes, $0
475. XSS-уязвимость, связанная с загрузкой файлов to VK.com - 30 upvotes, $0
476. [FG-VD-19-022] Wordpress WooCommerce Cross-Site Scripting Vulnerability Notification to Automattic - 30 upvotes, $0
477. XSS inside HTML Link Tag to OLX - 30 upvotes, $0
478. Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product to Shopify - 30 upvotes, $0
480. [api.tumblr.com] Exploiting clickjacking vulnerability to trigger self DOM-based XSS to Automattic - 30 upvotes, $0
481. Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml to
HackerOne - 30 upvotes, $0
482. Stored XSS on top.mail.ru to Mail.ru - 30 upvotes, $0
483. Reflected XSS on av.ru via q parameter at https://av.ru/collections/* to Azbuka Vkusa - 30 upvotes, $0
484. Cross-site Scripting (XSS) - Reflected to MTN Group - 30 upvotes, $0
485. Stored XSS in merge request creation page through payload in approval rule name to GitLab - 29 upvotes, $3000
486. Stored XSS on profile page via Steam display name to Rockstar Games - 29 upvotes, $1250
487. stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter to Rockstar Games - 29 upvotes,
$1000
488. XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app to Shopify - 29 upvotes, $800
489. Self-XSS in password reset functionality to Shopify - 29 upvotes, $500
490. XSS в колбек апи в сообществах to VK.com - 29 upvotes, $500
491. Stored XSS on promo.indrive.com to inDrive - 29 upvotes, $284
492. DOM Based XSS in Discourse Search to Discourse - 29 upvotes, $256
493. XSS in (Support Requests) : User Cases to Acronis - 29 upvotes, $50
494. Reflected XSS in www.dota2.com to Valve - 29 upvotes, $0
495. Reflected XSS in www.olx.co.id to OLX - 29 upvotes, $0
496. Stored XSS at https://app.smtp2go.com/settings/users/ to SMTP2GO - 29 upvotes, $0
497. HTTP Request Smuggling on api.flocktory.com Leads to XSS on Customer Sites to QIWI - 29 upvotes, $0
498. xss due to incorrect handling of postmessages to Khan Academy - 29 upvotes, $0
499. Stored XSS on wordpress.com to Automattic - 29 upvotes, $0
500. CRLF and XSS stored on ton.twitter.com to X (Formerly Twitter) - 28 upvotes, $1680
501. Stored XSS in Dovetale by application of creator to Shopify - 28 upvotes, $1600
502. Stored XSS(Cross Site Scripting) In Slack App Name to Slack - 28 upvotes, $1000
503. o2.mail.ru XSS to Mail.ru - 28 upvotes, $1000
504. Reflected XSS in error pages (NC-SA-2017-008) to Nextcloud - 28 upvotes, $450
505. Persistent XSS via Signatures to Vanilla - 28 upvotes, $300
506. [allhiphop.vanillacommunities.com] XSS Request-URI to Vanilla - 28 upvotes, $100
507. XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js to Rockstar Games - 28 upvotes, $0
508. Reflected XSS on the data.gov (WAF bypass+ Chrome XSS Auditor bypass+ works in all browsers) to GSA Bounty - 28 upvotes, $0
509. [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection to WordPress - 28 upvotes, $0
510. [qiwi.com] XSS on payment form to QIWI - 28 upvotes, $0
511. XSS Stored to Coursera - 28 upvotes, $0
512. DOM XSS in edoverflow.com/tools/respond due to unsafe usage of the innerHTML property. to Ed - 28 upvotes, $0
513. Stored Cross Site Scripting on Zendesk agent dashboard to Zendesk - 28 upvotes, $0
514. Reflected Xss to U.S. Dept Of Defense - 28 upvotes, $0
515. Self xss in product reviews to Shopify - 28 upvotes, $0
516. Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter to Glassdoor - 28 upvotes, $0
517. Stored XSS in Satisfaction Surveys via "Ask Reason for Dissatisfaction" option to Lark Technologies - 28 upvotes, $0
518. Stored XSS in "product type" field executed via product filters to Judge.me - 28 upvotes, $0
519. XSS in http://www.glassdoor.com/Search/results.htm via Parameter Pollution to Glassdoor - 28 upvotes, $0
520. Stored XSS in group issue list to GitLab - 27 upvotes, $2000
521. Stored XSS in snapmatic comments to Rockstar Games - 27 upvotes, $1000
522. [web.icq.com] Stored XSS in "О Контакте" to Mail.ru - 27 upvotes, $500
523. Persistent XSS at verkkopalvelu.tapiola.fi using spoofed React element and React v.0.13.3 to LocalTapiola - 27 upvotes, $300
524. Reflected XSS at city-mobil.ru to Mail.ru - 27 upvotes, $300
525. XSS in vk.link to VK.com - 27 upvotes, $300
526. CSS injection via BB code tag "█████" to phpBB - 27 upvotes, $0
527. Search input is vulnerable for XSS in qa.td.com and dev.td.com to TD Bank - 27 upvotes, $0
528. Basic XSS [WAF Bypasses] to Cloudflare Public Bug Bounty - 26 upvotes, $50
529. DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request to Rockstar Games - 26 upvotes, $0
530. [GitHub Extension] Unsanitised HTML leading to XSS on GitHub.com to Algolia - 26 upvotes, $0
531. Cloudflare based XSS for IE11 to Cloudflare Vulnerability Disclosure - 26 upvotes, $0
532. Reflected XSS in /Videos/ via calling a callback http://www.rockstargames.com/videos/#/?lb= to Rockstar Games - 26 upvotes, $0
533. Preview bar: Incomplete message origin validation results in XSS to Shopify - 26 upvotes, $0
534. Stored - XSS to Shopify - 26 upvotes, $0
535. Stored XSS in Macro Editing - Introduced by Admins to affect Admins to Zendesk - 26 upvotes, $0
536. DOM XSS on app.starbucks.com via ReturnUrl to Starbucks - 26 upvotes, $0
537. Cross-site Scripting (XSS) - DOM - iqcard.informatica.com to Informatica - 26 upvotes, $0
538. Bypass extension check leads to stored XSS at https://s2.booth.pm to pixiv - 26 upvotes, $0
539. CSRF + XSS leads to ATO to Mail.ru - 26 upvotes, $0
540. XSS Stored in Cacheable response to Acronis - 26 upvotes, $0
541. Stored DOM XSS via Mermaid chart to GitLab - 25 upvotes, $3000
542. Reflected cross-site scripting (XSS) on api.tiles.mapbox.com to Mapbox - 25 upvotes, $1000
543. Stored XSS on member post feed to Rockstar Games - 25 upvotes, $1000
544. cross site scripting bypass session to Mail.ru - 25 upvotes, $1000
545. Stored XSS in history on [corporate.city-mobil.ru] to Mail.ru - 25 upvotes, $300
546. XSS reflected on [https://www.youporn.com] to Pornhub - 25 upvotes, $150
547. Cross Site Scripting (Reflected) on https://www.acronis.cz/ to Acronis - 25 upvotes, $50
548. WordPress core stored XSS via attachment file name to Automattic - 25 upvotes, $0
549. Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire to Rockstar Games - 25 upvotes, $0
550. XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod) to Starbucks - 25 upvotes, $0
551. Stored xss в пересланном сообщении. to Mail.ru - 25 upvotes, $0
552. Self-XSS to Good-XSS - pornhub.com to Pornhub - 25 upvotes, $0
553. stored xss in app.lemlist.com to lemlist - 25 upvotes, $0
554. Cross Site Scripting using Email parameter in Ads endpoint 2 to TikTok - 25 upvotes, $0
555. [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id} to Automattic - 25 upvotes, $0
556. CSRF to Cross-site Scripting (XSS) to U.S. Dept Of Defense - 25 upvotes, $0
557. Reflected XSS to U.S. Dept Of Defense - 25 upvotes, $0
558. Stored XSS in repository file viewer to GitLab - 24 upvotes, $2000
559. Universal XSS with Playlist feature to Brave Software - 24 upvotes, $750
560. [e.mail.ru] Stored xss in Mpop cookie to Mail.ru - 24 upvotes, $600
561. Blind stored xss in demo form to Upserve - 24 upvotes, $500
562. XSS via the lang parameter in a POST request on light.mail.ru to Mail.ru - 24 upvotes, $500
563. Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilities to Uber - 24 upvotes, $500
564. Stored XSS in api.icq.net to Mail.ru - 24 upvotes, $150
565. HTML injection leads to reflected XSS to Zomato - 24 upvotes, $150
566. Blind Stored XSS on iOS App due to Unsanitized Webview to Nextcloud - 24 upvotes, $100
567. Stored Cross-Site-Scripting in CMS Airship's authors profiles to Paragon Initiative Enterprises - 24 upvotes, $0
568. [stagecafrstore.starbucks.com] CRLF Injection, XSS to Starbucks - 24 upvotes, $0
569. [growth.grab.com] Reflected XSS via Base64-encoded "q" param on "my.html" Valentine's microsite to Grab - 24 upvotes, $0
570. Reflected XSS в /al_audio.php to VK.com - 24 upvotes, $0
571. XSS in touch.mail.ru to Mail.ru - 24 upvotes, $0
572. Persistent XSS via e-mail when creating merge requests to GitLab - 24 upvotes, $0
573. Stored XSS in Review Section https://games.mail.ru/ to Mail.ru - 24 upvotes, $0
574. Authenticated Stored Cross-site Scripting in bbPress to WordPress - 24 upvotes, $0
575. [tumblr.com] 69< Firefox Only XSS Reflected to Automattic - 24 upvotes, $0
576. Reflected XSS on /admin/stats.php to Revive Adserver - 24 upvotes, $0
577. Stored XSS in the banner block description to Stripo Inc - 24 upvotes, $0
578. Stored Cross-Site Scripting vulnerability in example Custom Digital Agreement to HackerOne - 24 upvotes, $0
579. Stored XSS on PyPi simple API endpoint to GitLab - 23 upvotes, $3000
580. Universal Cross-Site Scripting in Keybase Chrome extension to Keybase - 23 upvotes, $500
581. DOM Based XSS charting_library to Gatecoin - 23 upvotes, $500
582. Persistent XSS via filename in projects to Nextcloud - 23 upvotes, $150
583. Reflected XSS in the IE 11 / Edge (latest versions) on the stage-go.wepay.com to WePay - 23 upvotes, $100
584. Reflected XSS on developers.zomato.com to Zomato - 23 upvotes, $100
585. Reflected XSS on my.acronis.com to Acronis - 23 upvotes, $50
586. Wordpress 4.7.2 - Two XSS in Media Upload when file too large. to WordPress - 23 upvotes, $0
587. XSS в личных сообщениях to VK.com - 23 upvotes, $0
588. XSS Reflected on my_report to Semrush - 23 upvotes, $0
589. Camo Image Proxy Bypass with CSS Escape Sequences to Chaturbate - 23 upvotes, $0
590. Stored XSS on Broken Themes via filename to WordPress - 23 upvotes, $0
591. Reflected XSS in https://www.█████/ to U.S. Dept Of Defense - 23 upvotes, $0
592. Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app) to Rocket.Chat - 23 upvotes, $0
593. Stored XSS at Module Name to Stripo Inc - 23 upvotes, $0
594. XSS seems to work again after change to linkpop at https://linkpop.com/testnaglinagli to Shopify - 23 upvotes, $0
595. Dom-Based XSS on parameter ?vsid= to JetBlue - 23 upvotes, $0
596. Reflected xss on https://█████████ to U.S. Dept Of Defense - 23 upvotes, $0
597. Reflected XSS on https://e.mail.ru/compose/ via Body parameter to Mail.ru - 22 upvotes, $1000
598. Stored XSS on Share-popup of a directory's Gallery-view to Nextcloud - 22 upvotes, $750
599. File Upload XSS in image uploading of App in mopub to X (Formerly Twitter) - 22 upvotes, $560
600. Stored XSS on apps.shopify.com to Shopify - 22 upvotes, $500
601. XSS on Brave Today through custom RSS feed to Brave Software - 22 upvotes, $500
602. Stored XSS in Public Profile Reviews to Judge.me - 22 upvotes, $250
603. XSS in PDF Viewer to Nextcloud - 22 upvotes, $100
604. Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments) to Starbucks - 22 upvotes, $0
605. [newscdn.starbucks.com] CRLF Injection, XSS to Starbucks - 22 upvotes, $0
606. Possibility to insert stored XSS inside <img> tag to Pornhub - 22 upvotes, $0
607. Admin bar: Incomplete message origin validation results in XSS to Shopify - 22 upvotes, $0
608. Self DOM-Based XSS in www.hackerone.com to HackerOne - 22 upvotes, $0
609. [kb.informatica.com] Dom Based xss to Informatica - 22 upvotes, $0
610. XSS via unicode characters in upload filename to WordPress - 22 upvotes, $0
611. xss triggered in "myshopify.com/admin/product" to Shopify - 22 upvotes, $0
612. Stored XSS on oslo.io in notifications via project name change to Logitech - 22 upvotes, $0
613. CVE-2022-23519: Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style) to Internet Bug Bounty -
21 upvotes, $2400
614. [Web ICQ Client] XSS уязвимость в имени пользователя to Mail.ru - 21 upvotes, $1000
615. Stored XSS in e.mail.ru (payload affect multiple users) to Mail.ru - 21 upvotes, $750
616. XSS on manually entering Postal codes to Shopify - 21 upvotes, $500
617. Reflected XSS via Double Encoding to Rockstar Games - 21 upvotes, $500
618. [render.bitstrips.com] Stored XSS via an incorrect avatar property value to Snapchat - 21 upvotes, $400
619. XSS Challenge to BugPoC - 21 upvotes, $300
620. Stored blind xss on showmax support team to Showmax - 21 upvotes, $256
621. CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud to Acronis - 21 upvotes, $250
622. XSS in OAuth Redirect Url to Dropbox - 21 upvotes, $0
623. XSS in zendesk.com/product/ to Zendesk - 21 upvotes, $0
624. Stored XSS in community.ubnt.com to Ubiquiti Inc. - 21 upvotes, $0
625. DOM Based XSS In mercantile.wordpress.org to WordPress - 21 upvotes, $0
626. xss filter bypass [polldaddy] to Automattic - 21 upvotes, $0
627. Potential XSS vulnerability to HTML minification to Cloudflare Vulnerability Disclosure - 21 upvotes, $0
628. Stored XSS in learnboost.com via the lesson[goals] parameter. to Automattic - 21 upvotes, $0
629. Reflected Swf XSS In ( plugins.svn.wordpress.org ) to WordPress - 21 upvotes, $0
630. [*.rocketbank.ru] Web Cache Deception & XSS to QIWI - 21 upvotes, $0
631. [contact-sys.com] XSS /ajax/transfer/status trn param to QIWI - 21 upvotes, $0
632. [takeapeek] XSS via HTML tag injection in directory lisiting page to Node.js third-party modules - 21 upvotes, $0
633. XSS web.icq.com double linkify to Mail.ru - 21 upvotes, $0
634. XSS in messages on geekbrains.ru to Mail.ru - 21 upvotes, $0
635. Xss Reflected On spgw.terrhq.ru [ url ] to Mail.ru - 21 upvotes, $0
636. Stored XSS on Zeit.co user profile to Vercel - 21 upvotes, $0
637. H1514 Stored XSS on Wholesale sales channel allows cross-organization data leakage to Shopify - 21 upvotes, $0
638. H1514 Stored XSS in Return Magic App portal content to Shopify - 21 upvotes, $0
639. Reflected XSS on https://go.mail.ru/search?fr=mn&q=<payload> to Mail.ru - 21 upvotes, $0
640. Cross-site Scripting (XSS) - Reflected vseapteki.ru to Mail.ru - 21 upvotes, $0
641. Stored XSS in https://app.mopub.com to X (Formerly Twitter) - 21 upvotes, $0
642. Solution for XSS challenge calc.buggywebsite.com to BugPoC - 21 upvotes, $0
643. XSS / SELF XSS to Shopify - 21 upvotes, $0
644. [icq.im] Reflected XSS via chat invite link to Mail.ru - 21 upvotes, $0
645. Reflected XSS in https://www.██████/ to U.S. Dept Of Defense - 21 upvotes, $0
646. XSS :D to BugPoC - 21 upvotes, $0
647. Reflected XSS in https://www.topcoder.com/blog/category/community-stories/ to Topcoder - 21 upvotes, $0
648. CVE-2020-11110: Grafana Unauthenticated Stored XSS -████.bizml.ru to Mail.ru - 21 upvotes, $0
649. Reflected XSS в m.vk.com to VK.com - 21 upvotes, $0
650. add class vulnerable Stored XSS to Mail.ru - 21 upvotes, $0
651. слепая XSS в админ панели torg.mail.ru через отзыв to Mail.ru - 20 upvotes, $500
652. Blind Stored XSS In "Report a Problem" on www.data.gov/issue/ to GSA Bounty - 20 upvotes, $300
653. Data URI Stored XSS on Donations Page to Mail.ru - 20 upvotes, $200
654. [Markdown] Stored XSS via character encoding parser bypass to GitLab - 20 upvotes, $0
655. Reflected xss on theacademy.upserve.com to Upserve - 20 upvotes, $0
656. reflected XSS avito.ru to Avito - 20 upvotes, $0
657. Stored XSS in infogram.com via language to Infogram - 20 upvotes, $0
658. Xss on community.imgur.com to Imgur - 20 upvotes, $0
659. [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II to WordPress - 20 upvotes, $0
660. Reflected XSS to OWOX, Inc. - 20 upvotes, $0
661. XSS in select attribute options to Concrete CMS - 20 upvotes, $0
662. Stored Cross Site Scripting. to 8x8 - 20 upvotes, $0
663. Stored XSS In mlbootcamp.ru to Mail.ru - 20 upvotes, $0
664. XSS through image upload of contacts using svg file with png extension to Nextcloud - 20 upvotes, $0
665. Reflected XSS on /admin/userlog-index.php to Revive Adserver - 20 upvotes, $0
666. Stored XSS on 1.4.0 to ImpressCMS - 20 upvotes, $0
667. XSS in www.glassdoor.com to Glassdoor - 20 upvotes, $0
668. XSS @ love.uber.com to Uber - 19 upvotes, $3000
669. Stored XSS in dropboxforum.com to Dropbox - 19 upvotes, $512
670. XSS in e.mail.ru to Mail.ru - 19 upvotes, $500
671. Stored XSS in "post last edited" option to Discourse - 19 upvotes, $256
672. [parcel.grab.com] DOM XSS at /assets/bower_components/lodash/perf/ to Grab - 19 upvotes, $200
673. Solution to the XSS Challenge to BugPoC - 19 upvotes, $200
674. XSS through image upload of contacts using svg file to Nextcloud - 19 upvotes, $100
675. Cross-Site Scripting Reflected On Main Domain to Instacart - 19 upvotes, $0
676. XSS vulnerability using GIF tags to Pornhub - 19 upvotes, $0
677. XSS in the search bar of mercantile.wordpress.org to WordPress - 19 upvotes, $0
678. Stored XSS in comments on https://www.starbucks.co.uk/blog/* to Starbucks - 19 upvotes, $0
679. Stored XSS with CRLF injection via post message to user feed to Rockstar Games - 19 upvotes, $0
680. Admin Macro Description Stored XSS to Zendesk - 19 upvotes, $0
681. Search Page Reflected XSS on sharjah.dubizzle.com through unencoded output of GET parameter in JavaScript to OLX - 19 upvotes, $0
682. [seeftl] Stored XSS when directory listing via filename. to Node.js third-party modules - 19 upvotes, $0
683. XSS at go.mail.ru to Mail.ru - 19 upvotes, $0
684. Stored XSS in Application menu via Home Page Url to Ping Identity - 19 upvotes, $0
685. Reflected XSS on a Atavist theme to Automattic - 19 upvotes, $0
686. Reflected XSS via IE to Nord Security - 19 upvotes, $0
687. Stored XSS in calendar via UID parameter to Mail.ru - 19 upvotes, $0
688. Stealing app credentials by reflected xss on Lark Suite to Lark Technologies - 19 upvotes, $0
689. Reflected XSS on ███ to U.S. Dept Of Defense - 19 upvotes, $0
690. Reflected XSS on mtnhottseat.mtn.com.gh to MTN Group - 19 upvotes, $0
691. Blind XSS Stored and CORS misconfiguration в отчете "События" сервиса top.mail.ru to Mail.ru - 19 upvotes, $0
692. Reflected xss в m.vk.com/chatjoin to VK.com - 19 upvotes, $0
693. Cross-site Scripting (XSS) - Stored | forum.acronis.com to Acronis - 19 upvotes, $0
694. Reflected XSS on https://help.glassdoor.com/gd_requestsubmitpage to Glassdoor - 19 upvotes, $0
695. Reflected Cross site scripting via Swagger UI to Adobe - 19 upvotes, $0
696. Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin to Uber - 18 upvotes, $5000
697. XSS в выборе товара. to VK.com - 18 upvotes, $500
698. XSS on opening a malicious OpenOffice text document to Open-Xchange - 18 upvotes, $400
699. [com.exness.android.pa Android] Universal XSS in webview. Lead to steal user cookies to EXNESS - 18 upvotes, $400
700. stored xss in comments : driver exam to Grab - 18 upvotes, $250
701. XSS on OAuth authorize/authenticate endpoint to X (Formerly Twitter) - 18 upvotes, $0
702. Stored xss in ALBUM DESCRIPTION to Imgur - 18 upvotes, $0
703. XSS at in instacart.com/store/partner_recipe to Instacart - 18 upvotes, $0
704. XSS on vimeo.com/home after other user follows you to Vimeo - 18 upvotes, $0
705. Stored xss в /lead_forms_app.php to VK.com - 18 upvotes, $0
706. XSS on https://account.mail.ru/login via postMessage to Mail.ru - 18 upvotes, $0
707. Reflected XSS using Header Injection to Semrush - 18 upvotes, $0
708. XSS vulnerability in sanitize-method when parsing link's href to Ruby on Rails - 18 upvotes, $0
709. DOM XSS on 1.1.1.1(one.one.one.one) to Cloudflare Vulnerability Disclosure - 18 upvotes, $0
710. XSS Reflected at SEARCH >> to OLX - 18 upvotes, $0
711. BUG XSS IN "ADD IMAGES" to Imgur - 18 upvotes, $0
712. Reflected XSS on https://apps.topcoder.com/wiki/page/ to Topcoder - 18 upvotes, $0
713. XSS Reflect to POST █████ to U.S. Dept Of Defense - 18 upvotes, $0
714. XSS (reflected, and then, cookie persisted) on api documentation site theme selector (old version of dokuwiki) to Mail.ru - 18 upvotes, $0
715. Self stored Xss + Login Csrf to U.S. Dept Of Defense - 18 upvotes, $0
716. reflected xss on the path m.tiktok.com to TikTok - 18 upvotes, $0
717. Stored XSS for Grafana dashboard URL to GitLab - 18 upvotes, $0
718. HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension to HackerOne - 18 upvotes, $0
719. Reflected XSS in ████████████ to U.S. Dept Of Defense - 18 upvotes, $0
720. XSS on partners.uber.com due to no user input sanitisation to Uber - 17 upvotes, $1000
721. [Web ICQ Client] XSS-inj in polls to Mail.ru - 17 upvotes, $1000
722. [IMP] - Blind XSS in the admin panel for reviewing comments to Rockstar Games - 17 upvotes, $650
723. Хранимая XSS в группе VK to VK.com - 17 upvotes, $500
724. Reflected XSS on molpay.com with cloudflare bypass to Razer - 17 upvotes, $375
725. OX (Guard): Stored Cross-Site Scripting via Email Attachment to Open-Xchange - 17 upvotes, $300
726. Reflected XSS on https://www.easytopup.in.th/store/product/return on parameter mref_id to Razer - 17 upvotes, $250
727. Stored XSS на странице "Изменить клиента", вкладка "История" [city-mobil.ru/taxiserv] to Mail.ru - 17 upvotes, $150
728. Stored XSS on chaturbate.com (wish list) to Chaturbate - 17 upvotes, $100
729. [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only to Nextcloud - 17 upvotes, $100
730. Stored XSS Via Filename On https://partners.line.me/ to LY Corporation - 17 upvotes, $100
731. DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter] to Acronis - 17 upvotes, $50
732. Cross-site scripting on the main page of flickr by tagging a user. to Yahoo! - 17 upvotes, $0
733. Stored XSS to Instacart - 17 upvotes, $0
734. [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html to Ubiquiti Inc. - 17 upvotes, $0
735. XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth to Mapbox - 17 upvotes, $0
736. Store XSS on Informatica University via transcript (informatica.csod.com) to Informatica - 17 upvotes, $0
737. Reflected XSS in reddeadredemption Site located at www.rockstargames.com/reddeadredemption to Rockstar Games - 17 upvotes, $0
738. Persistent XSS found on bin.pinion.gg due to outdated FlowPlayer SWF file with Remote File Inclusion vulnerability. to Unikrn - 17 upvotes, $0
739. DOM-based XSS in store.starbucks.co.uk on IE 11 to Starbucks - 17 upvotes, $0
740. XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=... to Quora - 17 upvotes, $0
741. Reflected XSS vulnerability in Database name field on installation screen to Concrete CMS - 17 upvotes, $0
742. Cross Site Scripting -> Reflected XSS to OLX - 17 upvotes, $0
743. Reflected XSS to Informatica - 17 upvotes, $0
744. [wallet.rapida.ru] XSS Cookie flashcookie to QIWI - 17 upvotes, $0
745. Stored XSS in merge request pages to GitLab - 17 upvotes, $0
746. Reflected XSS / Markup Injection in index.php/svg/core/logo/logo parameter color to Nextcloud - 17 upvotes, $0
747. Self XSS combine CSRF at https://████████/index.php to U.S. Dept Of Defense - 17 upvotes, $0
748. Stored XSS firing at the "Add chart to note" popup to New Relic - 17 upvotes, $0
749. Stored XSS firing at transaction map (applicationName field) to New Relic - 17 upvotes, $0
750. Probably unexploitable XSS via Header Injection to WHO COVID-19 Mobile App - 17 upvotes, $0
751. Reflected XSS on dailydeals.mtn.co.za to MTN Group - 17 upvotes, $0
752. Self XSS in attachments name to Acronis - 17 upvotes, $0
753. [hta3] Chain of ESI Injection & Reflected XSS leading to Account Takeover on [███] to U.S. Dept Of Defense - 17 upvotes, $0
754. xss and html injection on ( https://labs.history.state.gov) to U.S. Department of State - 17 upvotes, $0
755. reflected XSS in [www.equifax.com] to Equifax-vdp - 17 upvotes, $0
756. XSS в товарах to VK.com - 16 upvotes, $1000
757. XSS в теле письма. to Mail.ru - 16 upvotes, $1000
758. Blind Stored XSS to Mail.ru - 16 upvotes, $550
759. stored xss in invited team member via email parameter to Shopify - 16 upvotes, $500
760. Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/ to Uber - 16 upvotes, $500
761. DOM XSS vulnerability in search dialogue (NC-SA-2017-007) to Nextcloud - 16 upvotes, $250
762. Stored XSS на странице "Измененить водителя" [city-mobil.ru/taxiserv] to Mail.ru - 16 upvotes, $150
763. Reflected XSS at https://stories.showmax.com/wp-content/themes/theme-internal_ss/blocks/ajax/a.php via ss_country_filter param to
Showmax - 16 upvotes, $150
764. XSS on https://www.delivery-club.ru to Mail.ru - 16 upvotes, $100
765. Reflected XSS when renaming a file with a vulnerable name which results in an error to Nextcloud - 16 upvotes, $100
766. Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-event to Imgur - 16 upvotes, $0
767. Stored XSS at https://finance.owox.com/customer/accountList to OWOX, Inc. - 16 upvotes, $0
768. [controlsyou.quora.com] 429 Too Many Requests Error-Page XSS to Quora - 16 upvotes, $0
769. Stored XSS on Files overview by abusing git submodule URL to GitLab - 16 upvotes, $0
770. Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter to WordPress - 16 upvotes, $0
771. [app.simplenote.com] Stored XSS via Markdown SVG filter bypass to Automattic - 16 upvotes, $0
772. Stored XSS via Send crew invite to Rockstar Games - 16 upvotes, $0
773. Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute to Ubiquiti Inc. - 16 upvotes, $0
774. [airbnb.com] XSS via Cookie flash to Airbnb - 16 upvotes, $0
775. Stored XSS in www.learnboost.com via ZIP codes. to Automattic - 16 upvotes, $0
776. Authenticated reflected XSS on liberapay.com via the back_to parameter when leaving a team. to Liberapay - 16 upvotes, $0
777. Reflective XSS at olx.ph to OLX - 16 upvotes, $0
778. Reflected XSS to Ubiquiti Inc. - 16 upvotes, $0
779. Blind XSS in the rocket.chat registration email to Rocket.Chat - 16 upvotes, $0
780. DOM XSS on 50x.html page to DuckDuckGo - 16 upvotes, $0
781. XSS in e.mail.ru to Mail.ru - 16 upvotes, $0
782. [sms.qiwi.ru] XSS via Request-URI to QIWI - 16 upvotes, $0
783. Cross Site Scripting at https://app.oberlo.com/ to Shopify - 16 upvotes, $0
784. Dom based xss on https://www.rockstargames.com/ via returnUrl parameter to Rockstar Games - 16 upvotes, $0
785. Stored XSS at [ https://app.lemlist.com/campaigns/cam_QRS5caF2ca7MJtiLS/leads ] in " LINKEDIN URL" Field. to lemlist - 16 upvotes, $0
786. XSS in desktop client via invalid server address on login form to Nextcloud - 16 upvotes, $0
787. Multiple Cross-Site Scripting vulnerability via the language parameter to TikTok - 16 upvotes, $0
788. Reflected XSS on /www/delivery/afr.php (bypass of report #775693) to Revive Adserver - 16 upvotes, $0
789. Reflected XSS on https://█████████/ to U.S. Dept Of Defense - 16 upvotes, $0
790. Stored XSS on {https://calendar.mail.ru/} to Mail.ru - 16 upvotes, $0
791. Reflected XSS at https://www.glassdoor.com/Interview/Accenturme-Interview-Questions-E9931.htm via filter.jobTitleFTS parameter to Glassdoor
- 16 upvotes, $0
792. New experimental query: Clipboard-based XSS to GitHub Security Lab - 16 upvotes, $0
793. Stored XSS in files.slack.com to Slack - 16 upvotes, $0
794. Stored xss on helpdesk using user's city to Lark Technologies - 16 upvotes, $0
795. DOM XSS through ads to Urban Dictionary - 16 upvotes, $0
796. DOM XSS on www.adobe.com to Adobe - 16 upvotes, $0
797. Reflected XSS on ██████.mil to U.S. Dept Of Defense - 16 upvotes, $0
798. ActionView sanitize helper bypass leading to XSS using SVG tag. to Ruby on Rails - 16 upvotes, $0
799. XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256) to Ruby - 16 upvotes, $0
800. Self XSS when pasting HTML into Text app with Ctrl+Shift+V to Nextcloud - 16 upvotes, $0
801. Stored XSS via "my recent queries" selector in NRQL dashboard builder to New Relic - 15 upvotes, $2500
802. Another Stored XSS in mail app using Drive app to Open-Xchange - 15 upvotes, $500
803. Reflected XSS at https://sea-web.gold.razer.com/cash-card/verify via channel parameter to Razer - 15 upvotes, $500
804. XSS - Search - Unescaped contact job to Open-Xchange - 15 upvotes, $450
805. Stored XSS on invoice, executing on any subdomain to Harvest - 15 upvotes, $350
806. xss in Theme http://bztfashion.booztx.com to Boozt Fashion AB - 15 upvotes, $250
807. Mobile Reflect XSS / CSRF at Advertisement Section on Search page to Pornhub - 15 upvotes, $200
808. Stored XSS на странице "Изменить клиента" [city-mobil.ru/taxiserv] to Mail.ru - 15 upvotes, $150
809. XSS in instacart.com/store/partner_recipe to Instacart - 15 upvotes, $100
810. XSS Yahoo Messenger Via Calendar.Yahoo.Com to Yahoo! - 15 upvotes, $0
811. Content-type sniffing leads to stored XSS in CMS Airship on Internet Explorer to Paragon Initiative Enterprises - 15 upvotes, $0
812. XSS using javascript:alert(8007) to X (Formerly Twitter) - 15 upvotes, $0
813. XSS on postal codes to Shopify - 15 upvotes, $0
814. Dom Based Xss DIV.innerHTML parameters store.starbucks* to Starbucks - 15 upvotes, $0
815. Stored XSS to Mail.ru - 15 upvotes, $0
816. DOM XSS on teavana.com via "pr_zip_location" parameter to Starbucks - 15 upvotes, $0
817. Cross-site Scripting (XSS) on [maximum.nl] to Radancy - 15 upvotes, $0
818. Reflected XSS on teavana.com (Locale-Change) to Starbucks - 15 upvotes, $0
819. XSS on pornhubselect.com to Pornhub - 15 upvotes, $0
820. Stored self-XSS in mercantile.wordpress.org checkout to WordPress - 15 upvotes, $0
821. Big XSS vulnerability! to Legal Robot - 15 upvotes, $0
822. Double Stored Cross-Site scripting in the admin panel to GSA Bounty - 15 upvotes, $0
823. Authenticated Cross-site Scripting in Template Name to WordPress - 15 upvotes, $0
824. Stored CSS Injection to Coinbase - 15 upvotes, $0
825. POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter to Khan Academy - 15 upvotes, $0
826. Stored XSS on Issue details page to GitLab - 15 upvotes, $0
827. [ibank.qiwi.ru] XSS via Request-URI to QIWI - 15 upvotes, $0
828. Reflected XSS in the npm module express-cart. to Node.js third-party modules - 15 upvotes, $0
829. Cross site scripting vulnerability in JW Player SWF to Mail.ru - 15 upvotes, $0
830. DOM XSS via Shopify.API.remoteRedirect to Shopify - 15 upvotes, $0
831. XSS на странице account.mail.ru/recovery to Mail.ru - 15 upvotes, $0
832. Cross-site Scripting (XSS) - Stored in ru.mail.mailapp to Mail.ru - 15 upvotes, $0
833. Reflected XSS: Taxonomy Converter via tax parameter to WordPress - 15 upvotes, $0
834. Хранимая XSS в личных сообщениях новое место to ok.ru - 15 upvotes, $0
835. [█████] — DOM-based XSS on endpoint /?s= to U.S. Dept Of Defense - 15 upvotes, $0
836. Reflected xss on 8x8.vc to 8x8 Bounty - 15 upvotes, $0
837. Reflected XSS on www/delivery/afr.php to Revive Adserver - 15 upvotes, $0
838. Html Injection and Possible XSS in main nordvpn.com domain to Nord Security - 15 upvotes, $0
839. Dom based xss on /reddeadredemption2/br/videos to Rockstar Games - 15 upvotes, $0
840. Reflected XSS on http://info.ucs.ru/settings/check/ to Mail.ru - 15 upvotes, $0
841. Self XSS in Timeline to Shopify - 15 upvotes, $0
842. Cross Site Scripting (XSS) Stored - Private messaging to Concrete CMS - 15 upvotes, $0
843. Reflected XSS at /category/ on a Atavis theme to Automattic - 15 upvotes, $0
844. XSS in message attachment fileds. to Rocket.Chat - 15 upvotes, $0
845. Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and to U.S. Dept Of Defense - 15
upvotes, $0
846. Reflected XSS at https://www.glassdoor.co.in/Interview/BlackRock-Interview-Questions-E9331.htm via filter.jobTitleExact parameter to Glassdoor
- 15 upvotes, $0
847. XSS via X-Forwarded-Host header to U.S. Dept Of Defense - 15 upvotes, $0
848. Reflected XSS on play.mtn.co.za to MTN Group - 15 upvotes, $0
849. Reflected Xss in https://world.engelvoelkers.com/... to Engel & Völkers Technology GmbH - 15 upvotes, $0
850. Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode to Acronis - 15 upvotes, $0
851. Cross-site scripting via hardcoded front-end watched expression. to Quantopian - 14 upvotes, $1225
852. Blind XSS in mapbox.com/contact to Mapbox - 14 upvotes, $750
853. Reflected Cross-Site Scripting due to vulnerable Flash component (Flashmediaelement.swf) to Open-Xchange - 14 upvotes, $500
854. XSS - Notes - Attribute injection through overlapping tags to Open-Xchange - 14 upvotes, $450
855. xss reflected in littleguy.vanillastaging.com to Vanilla - 14 upvotes, $300
856. XSS в нике при запросе в контакты. to Mail.ru - 14 upvotes, $250
857. XSS при добавлении в чат пользователя to Mail.ru - 14 upvotes, $250
858. XSS при Изменения машины на странице "Контроль" [city-mobil.ru/taxiserv] to Mail.ru - 14 upvotes, $150
859. [github.algolia.com] DOM Based XSS github-btn.html to Algolia - 14 upvotes, $100
860. Reflected XSS on https://www.delivery-club.ru/ to Mail.ru - 14 upvotes, $100
861. xss vulnerability in http://ubermovement.com/community/daniel to Uber - 14 upvotes, $0
862. Unauthenticated Stored xss to Nextcloud - 14 upvotes, $0
863. Unauthenticated Stored XSS on <any>.myshopify.com via checkout page to Shopify - 14 upvotes, $0
864. XSS vulnerability on Audio and Video parsers to Discourse - 14 upvotes, $0
865. XSS Vulnerability on Image link parser to Discourse - 14 upvotes, $0
866. XSS in topics because of bandcamp preview engine vulnerability to Discourse - 14 upvotes, $0
867. Reflected XSS to Algolia - 14 upvotes, $0
868. XSS @ *.letgo.com to OLX - 14 upvotes, $0
869. DOM-based XSS on youporn.com (main page) to Pornhub - 14 upvotes, $0
870. Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com) to Starbucks - 14
upvotes, $0
871. Stored XSS in the any user profile using website link to Pornhub - 14 upvotes, $0
872. XSS в приглашении в группу to VK.com - 14 upvotes, $0
873. Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. to WordPress - 14 upvotes, $0
874. Reflected XSS on https://www.zomato.com to Zomato - 14 upvotes, $0
875. Stored XSS in partners dashboard to Shopify - 14 upvotes, $0
876. XSS in main search, use class tag to imitate Reverb.com core functionality, create false login window to Reverb.com - 14 upvotes, $0
877. [contact-sys.com] XSS via Request-URI to QIWI - 14 upvotes, $0
878. Reflected XSS on help.steampowered.com to Valve - 14 upvotes, $0
879. XSS on www.██████ alerts and a number of other pages to U.S. Dept Of Defense - 14 upvotes, $0
880. Stored XSS in Name of Team Member Invitation to Localize - 14 upvotes, $0
881. Reflected XSS on am.ru and subdomains to Mail.ru - 14 upvotes, $0
882. Reflected XSS via XML Namespace URI on https://go.mapbox.com/index.php/soap/ to Mapbox - 14 upvotes, $0
883. Reflected cross-site scripting vulnerability on a DoD website to U.S. Dept Of Defense - 14 upvotes, $0
884. Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII to Topcoder - 14
upvotes, $0
885. XSS Challenge #2 Solution to BugPoC - 14 upvotes, $0
886. XSS In https://docs.gocd.org/current/ to GoCD - 14 upvotes, $0
887. self-xss with ClickJacking can leads to account takeover in Firefox to Imgur - 14 upvotes, $0
888. Reflected XSS on a Atavist theme at external_import.php to Automattic - 14 upvotes, $0
889. Download full backup and Cross site scripting to ImpressCMS - 14 upvotes, $0
890. Reflected XSS on https://deti.mail.ru to Mail.ru - 14 upvotes, $0
891. Reflected XSS at https://www.glassdoor.co.in/Job/pratt-whitney-jobs-SRCH_KE0,13.htm?initiatedFromCountryPicker=true&countryRedirect=true
to Glassdoor - 14 upvotes, $0
892. Reflected XSS on gamesclub.mtn.com.g to MTN Group - 14 upvotes, $0
893. Reflected XSS at dailydeals.mtn.co.za to MTN Group - 14 upvotes, $0
894. xss reflected on imgur.com to Imgur - 14 upvotes, $0
895. cross site scripting in : mtn.bj to MTN Group - 14 upvotes, $0
896. XSS in Widget Review Form Preview in settings to Judge.me - 14 upvotes, $0
897. Cross-Site Request Forgery (CSRF) to xss to MTN Group - 14 upvotes, $0
898. reflected xss in www.████████.gov to U.S. Dept Of Defense - 14 upvotes, $0
899. Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability. to Ruby on
Rails - 14 upvotes, $0
900. XSS в теле письма, в новой версии почты. to Mail.ru - 13 upvotes, $1000
901. [www.dropboxforum.com] - reflected XSS in search to Dropbox - 13 upvotes, $512
902. [m.vk.com] XSS на страницах /artist/ to VK.com - 13 upvotes, $500
903. Reflected XSS in the shared note view on https://evernote.com to Evernote - 13 upvotes, $500
904. [chatws25.stream.highwebmedia.com] - Reflected XSS in c parameter to Chaturbate - 13 upvotes, $350
905. XSS on expenses attachments to Harvest - 13 upvotes, $250
906. XSS at af.attachmail.ru to Mail.ru - 13 upvotes, $150
907. Stored XSS в профиле водителя [city-mobil.ru/taxiserv] to Mail.ru - 13 upvotes, $150
908. Stored XSS на странице "Почты" [city-mobil.ru/taxiserv] to Mail.ru - 13 upvotes, $150
909. XSS на странице "Создать водителя" [city-mobil.ru/taxiserv] to Mail.ru - 13 upvotes, $150
910. Zomato.com Reflected Cross Site Scripting to Zomato - 13 upvotes, $100
911. lootdog.io XSS to Mail.ru - 13 upvotes, $100
912. Store XSS Flicker main page to Yahoo! - 13 upvotes, $0
913. Stored XSS via AngularJS Injection to drchrono - 13 upvotes, $0
914. xss in link items (mopub.com) to X (Formerly Twitter) - 13 upvotes, $0
915. Persistent XSS on public wiki pages to GitLab - 13 upvotes, $0
916. Stored XSS in topics because of whitelisted_generic engine vulnerability to Discourse - 13 upvotes, $0
917. Mixed Reflected-Stored XSS on pornhub.com (without user interaction) in the playlist playing section to Pornhub - 13 upvotes, $0
918. Stored XSS in *.myshopify.com to Shopify - 13 upvotes, $0
919. XSS on www.mapbox.com/authorize to Mapbox - 13 upvotes, $0
920. Dom based xss affecting all pages from https://www.grab.com/. to Grab - 13 upvotes, $0
921. Unauthenticated Reflected XSS in admin dashboard to Deconf - 13 upvotes, $0
922. XSS at https://app.goodhire.com/member/GH.aspx to Inflection - 13 upvotes, $0
923. SocialClub's Facebook OAuth Theft through Warehouse XSS. to Rockstar Games - 13 upvotes, $0
924. XSS on redirection page( Bypassed) to Semrush - 13 upvotes, $0
925. [mercantile.wordpress.org] Reflected XSS to WordPress - 13 upvotes, $0
926. XSS in buying and selling pages, can created spoofed content (false login message) to Reverb.com - 13 upvotes, $0
927. 3rd party shop admin panel blind XSS to Mail.ru - 13 upvotes, $0
928. Stored Cross-site scripting to Vercel - 13 upvotes, $0
929. Stored XSS in Rich editor via Embed datetime to Vanilla - 13 upvotes, $0
930. [okmedia.insideok.ru] Web Cache Poisoing & XSS to ok.ru - 13 upvotes, $0
931. Unrestricted File Upload To Xss Stored [ https://ideas.browser.mail.ru/ ] to Mail.ru - 13 upvotes, $0
932. Content Injection on api.semrush.com to Reflected XSS to Semrush - 13 upvotes, $0
933. XSS due to incomplete JS escaping to Ruby on Rails - 13 upvotes, $0
934. [geekbrains.ru] Reflected XSS via Angular Template Injection to Mail.ru - 13 upvotes, $0
935. Stored XSS at APM applications listing to New Relic - 13 upvotes, $0
936. Stored XSS at APM key transactions list to New Relic - 13 upvotes, $0
937. Stored XSS in Post Preview as Contributor to WordPress - 13 upvotes, $0
938. Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor. to Stripo
Inc - 13 upvotes, $0
939. DOM Based XSS on https://████ via backURL param to U.S. Dept Of Defense - 13 upvotes, $0
940. XSS DUE TO CVE-2020-3580 to U.S. Dept Of Defense - 13 upvotes, $0
941. stored XSS on AliExpress Review Importer/Products when delete product to Judge.me - 13 upvotes, $0
942. xss on [developers.mtn.com] to MTN Group - 13 upvotes, $0
943. Stored XSS at https://█████ to U.S. Dept Of Defense - 13 upvotes, $0
944. Self XSS in https://linkpop.com/dashboard/admin to Shopify - 13 upvotes, $0
945. Stored XSS in intensedebate.com via the Comments RSS to Automattic - 13 upvotes, $0
946. Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag to Internet Bug Bounty - 12 upvotes, $2400
947. XSS в письме, в поле отправителя. to Mail.ru - 12 upvotes, $1000
948. Universal XSS through FIDO U2F register from subframe to Brave Software - 12 upvotes, $1000
949. XSS @ store.steampowered.com via agecheck path name to Valve - 12 upvotes, $750
950. Stored XSS at 'Buy Button' page to Shopify - 12 upvotes, $500
951. reflected XSS on healt.mail.ru to Mail.ru - 12 upvotes, $500
952. OX Guard: DOM Based Cross-Site Scripting (#2) to Open-Xchange - 12 upvotes, $500
953. Reflected XSS and Open Redirect in several parameters (viestinta.lahitapiola.fi) to LocalTapiola - 12 upvotes, $450
954. Post Based Reflected XSS on [https://investor.razer.com/s/ir_contact.php] to Razer - 12 upvotes, $375
955. Stored XSS in Restoring Archived Tasks to Harvest - 12 upvotes, $250
956. XSS в названии лайвчата to Mail.ru - 12 upvotes, $250
957. store xss in calendar via upload filename to Open-Xchange - 12 upvotes, $250
958. stored xss путём загрузки вредоносного файла + обход загрузки файлов. to Mail.ru - 12 upvotes, $200
959. Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage() to Mail.ru - 12 upvotes, $200
960. [stage-go.wepay.com] XSS via Request URI to WePay - 12 upvotes, $100
961. Stored XSS using SVG to Paragon Initiative Enterprises - 12 upvotes, $0
962. [bbPress] Stored XSS in any forum post. to Automattic - 12 upvotes, $0
963. Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline to Shopify - 12 upvotes, $0
964. XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline to Shopify - 12 upvotes, $0
965. Follow Button XSS to Automattic - 12 upvotes, $0
966. stored XSS in olx.pl - ogloszenie TITLE element - moderator acc can be hacked to OLX - 12 upvotes, $0
967. DOM Based XSS on an Army website to U.S. Dept Of Defense - 12 upvotes, $0
968. WordPress <= 4.6.1 Stored XSS Via Theme File to Nextcloud - 12 upvotes, $0
969. Stored XSS in posts because of absence of oembed variables values escaping to Discourse - 12 upvotes, $0
970. dom xss in https://www.slackatwork.com to Slack - 12 upvotes, $0
971. Reflected XSS on blockchain.info to Blockchain - 12 upvotes, $0
972. Stored Cross Site Scripting in Customer Name to Moneybird - 12 upvotes, $0
973. Blind Stored XSS against Pornhub employees using Amateur Model Program to Pornhub - 12 upvotes, $0
974. [XSS/pay.qiwi.com] Pay SubDomain Hard-Use XSS to QIWI - 12 upvotes, $0
975. Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ] to Concrete CMS - 12 upvotes, $0
976. Stored XSS at Moneybird to Moneybird - 12 upvotes, $0
977. dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass) to Rockstar Games - 12 upvotes, $0
978. Lazy Load stored XSS to Automattic - 12 upvotes, $0
979. Unfiltered input allows for XSS in "Playtime Item Grants" fields to Valve - 12 upvotes, $0
980. Reflected XSS (myynti.lahitapiolarahoitus.fi) to LocalTapiola - 12 upvotes, $0
981. Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300 to Ubiquiti Inc. - 12 upvotes, $0
982. Torrent extension: Cross-origin downloading + "URL spoofing" + CSP-blocked XSS to Brave Software - 12 upvotes, $0
983. DOM XSS on 50x.html page on proxy.duckduckgo.com to DuckDuckGo - 12 upvotes, $0
984. [rm.mail.ru] Request-Path XSS to Mail.ru - 12 upvotes, $0
985. XSS to Mail.ru - 12 upvotes, $0
986. Html Injection and Possible XSS via MathML to X (Formerly Twitter) - 12 upvotes, $0
987. Reflected XSS on www.olx.co.id via ad_type parameter to OLX - 12 upvotes, $0
988. stored xss in https://www.smule.com to Smule - 12 upvotes, $0
989. Unauthenticated reflected XSS in preview_as_user function to Concrete CMS - 12 upvotes, $0
990. [htmr] DOM-based XSS to Node.js third-party modules - 12 upvotes, $0
991. Stored xss on https://go.mail.ru/ to Mail.ru - 12 upvotes, $0
992. XSS in [community.my.games] to Mail.ru - 12 upvotes, $0
993. [my.games] Stored XSS via untrusted bucket to Mail.ru - 12 upvotes, $0
994. DOM BASED XSS ON https://www.rockstargames.com/GTAOnline/features to Rockstar Games - 12 upvotes, $0
995. Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486) to Starbucks - 12 upvotes, $0
996. Reflected DOM XSS on www.starbucks.co.uk to Starbucks - 12 upvotes, $0
997. Reflected XSS to Mail.ru - 12 upvotes, $0
998. XSS on https://fax.pbx.itsendless.org/ (CVE-2017-18024) to Endless Group - 12 upvotes, $0
999. [m-server] XSS reflected because path does not escapeHtml to Node.js third-party modules - 12 upvotes, $0
000. reflected xss on learn.city-mobil.ru via redirect_url parameter to Mail.ru - 12 upvotes, $0
001. [sub.wordpress.com] - XSS when adjust block Poll - Confirmation Message - On submission:Redirect to another webpage - Redirect address:
[xss_payload] to Automattic - 12 upvotes, $0
002. Stored XSS in markdown file with Nextcloud Talk using Internet Explorer to Nextcloud - 12 upvotes, $0
003. Stored xss in larksuite internal helpdesk and other user's helpdesk. to Lark Technologies - 12 upvotes, $0
004. DOM-based XSS in d.miwifi.com on IE 11 to Xiaomi - 12 upvotes, $0
005. CSRF to Cross-site Scripting (XSS) to U.S. Dept Of Defense - 12 upvotes, $0
007. Reflected XSS through ClickJacking to U.S. Dept Of Defense - 12 upvotes, $0
008. Reflected XSS at [████████] to U.S. Dept Of Defense - 12 upvotes, $0
009. Bypassing SOP with XSS on account.my.games leading to steal CSRF token and user information to Mail.ru - 12 upvotes, $0
010. Universal Cross-Site Scripting vulnerability to Proctorio - 12 upvotes, $0
011. stand.pw.mail.ru xss to Mail.ru - 12 upvotes, $0
012. Reflected XSS on ███ via jobid parameter to Sony - 12 upvotes, $0
013. Reflected cross site scripting in https://███████ to U.S. Dept Of Defense - 12 upvotes, $0
014. xss on reset password page to U.S. Dept Of Defense - 12 upvotes, $0
015. DOM XSS at https://adobedocs.github.io/indesign-api-docs/?configUrl={site} due to outdated Swagger UI to Adobe - 12 upvotes, $0
016. XSS on ( █████████.gov ) Via URL path to U.S. Dept Of Defense - 12 upvotes, $0
017. Stored XSS via ' profile ' at https://www.miroyalcanin.cl/ to Mars - 12 upvotes, $0
018. Stored-XSS in https://www.coinbase.com/ to Coinbase - 11 upvotes, $5000
019. XSS in ubermovement.com via editable Google Sheets to Uber - 11 upvotes, $2000
020. Stored cross-site scripting in dataset owner. to Quantopian - 11 upvotes, $1925
021. Stored XSS on support.rockstargames.com to Rockstar Games - 11 upvotes, $1000
022. XSS в теле письма, в блочных стилях. to Mail.ru - 11 upvotes, $1000
023. Stored xss in calendar via call link to Mail.ru - 11 upvotes, $1000
024. Reflective XSS on wholesale.shopify.com to Shopify - 11 upvotes, $500
025. Xss в https://e.mail.ru/ to Mail.ru - 11 upvotes, $500
026. [account.mail.ru] XSS на странице восстановления пароля to Mail.ru - 11 upvotes, $500
027. Stored Blind XSS to Mail.ru - 11 upvotes, $500
028. Stored XSS in mail app to Open-Xchange - 11 upvotes, $500
029. XSS в названии звонка to VK.com - 11 upvotes, $500
030. XSS Vulnerability at https://www.pornhubpremium.com/premium_signup? URL endpoint to Pornhub - 11 upvotes, $250
031. [theacademy.upserve.com] Reflected XSS Query-String to Upserve - 11 upvotes, $250
032. Cross-site scripting on dashboard2.omise.co to Omise - 11 upvotes, $200
033. XSS on https://www.delivery-club.ru/sd/test_330933/info/ to Mail.ru - 11 upvotes, $100
034. DOM XSS on http://talks.lystit.com to Lyst - 11 upvotes, $100
035. Self-XSS on Suggest Tag dialog box to XVIDEOS - 11 upvotes, $50
036. Loadbalancer + URI XSS #3 to Yahoo! - 11 upvotes, $0
037. Stored xss to Algolia - 11 upvotes, $0
038. Stored XSS in unifi.ubnt.com to Ubiquiti Inc. - 11 upvotes, $0
039. Reflected Xss on to Pushwoosh - 11 upvotes, $0
040. [scores.ubnt.com] DOM based XSS at form.html to Ubiquiti Inc. - 11 upvotes, $0
041. Reflected cross-site scripting vulnerability on a DoD website to U.S. Dept Of Defense - 11 upvotes, $0
042. [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME to X (Formerly Twitter) - 11 upvotes, $0
043. [app.mixmax.com] Stored XSS on Adding new enhancement. to Mixmax - 11 upvotes, $0
044. Stored self-XSS pubg.mail.ru в нескольких местах to Mail.ru - 11 upvotes, $0
045. XSS with needed user intervention to Zendesk - 11 upvotes, $0
046. XSS через подгрузку ссылки. to Mail.ru - 11 upvotes, $0
047. Stored XSS in the Custom Logo link (non-Basic plan required) to Infogram - 11 upvotes, $0
048. Stored XSS on urbandictionary.com to Urban Dictionary - 11 upvotes, $0
049. Post Based XSS On Upload Via CK Editor [semrush.com] to Semrush - 11 upvotes, $0
050. Session ID is accessible via XSS to Inflection - 11 upvotes, $0
051. [web.icq.com] Stored XSS in link when sending message to Mail.ru - 11 upvotes, $0
052. Disclosure of user email address and Deanonymization [mail.ru] + Blind | Stored XSS pets.mail.ru to Mail.ru - 11 upvotes, $0
053. Reflected XSS of bbe-child-starter Theme via "value"-GET-parameter to LocalTapiola - 11 upvotes, $0
054. Stored XSS via Create Project (Add new translation project) to Weblate - 11 upvotes, $0
055. xss in /users/[id]/set_tier endpoint to RATELIMITED - 11 upvotes, $0
056. Reflected XSS on https://apps.topcoder.com/wiki/ to Topcoder - 11 upvotes, $0
057. Warehouse dom based xss may lead to Social Club Account Taker Over. to Rockstar Games - 11 upvotes, $0
058. Unrestricted File Upload Leads to XSS & Potential RCE to U.S. Dept Of Defense - 11 upvotes, $0
059. stored xss via Campaign Name. to lemlist - 11 upvotes, $0
060. Stored self XSS at auto.mail.ru using add_review functionality to Mail.ru - 11 upvotes, $0
061. xss while uploading a file to Mail.ru - 11 upvotes, $0
062. Cross-account stored XSS at notes (through "swf" note parameter) to New Relic - 11 upvotes, $0
063. pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment to WordPress - 11 upvotes, $0
064. Stored-Xss at connect.topcoder.com/projects/ affected on project chat members to Topcoder - 11 upvotes, $0
065. Session Hijack via Self-XSS to Rocket.Chat - 11 upvotes, $0
066. XSS в обработчике ссылок to VK.com - 11 upvotes, $0
067. Reflected XSS https://tracker.my.com to Mail.ru - 11 upvotes, $0
068. Blind Stored XSS on ███████ leads to takeover admin account to U.S. Dept Of Defense - 11 upvotes, $0
069. Cross site scripting to Informatica - 11 upvotes, $0
070. Improper Sanitization leads to XSS Fire on admin panel to Informatica - 11 upvotes, $0
071. Reflected Xss https://██████/ to U.S. Dept Of Defense - 11 upvotes, $0
072. Blind XSS via Digital Ocean Partner account creation form. to DigitalOcean - 11 upvotes, $0
073. XSS Reflected - ██████████ to U.S. Dept Of Defense - 11 upvotes, $0
074. Reflected XSS due to vulnerable version of sockjs to Automattic - 11 upvotes, $0
075. Able to bypass the fix on DOM XSS at [www.adobe.com] to Adobe - 11 upvotes, $0
076. Self-XSS due to image URL can be eploited via XSSJacking techniques in review email to Judge.me - 11 upvotes, $0
077. Reflected XSS on Admin Login Page to TD Bank - 11 upvotes, $0
078. Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle to Nextcloud - 11 upvotes, $0
079. XSS в письме, в теле письма. to Mail.ru - 10 upvotes, $2000
080. XSS by clicking Jira's link to GitLab - 10 upvotes, $1130
081. HTML Injection / Reflected Cross-Site Scripting with CSP on https://accounts.firefox.com/settings to Mozilla Critical Services - 10 upvotes, $1000
082. Xss в https://e.mail.ru/ to Mail.ru - 10 upvotes, $500
083. Reflected XSS in https://e.mail.ru/ to Mail.ru - 10 upvotes, $500
084. Хранимая XSS в функционале добавления аудио в WYSIWYG to VK.com - 10 upvotes, $500
085. Dropbox Paper - Markdown XSS to Dropbox - 10 upvotes, $343
086. Stored XSS in address on [corporate.city-mobil.ru] to Mail.ru - 10 upvotes, $300
087. Stored XSS in eaccounting.stage.vismaonline.com to Visma Public - 10 upvotes, $250
088. DOM-based XSS on https://zest.co.th/zestlinepay/ to Razer - 10 upvotes, $200
089. CSS leaks SCSS debug info to HackerOne - 10 upvotes, $0
090. XSS @ yaman.olx.ph to OLX - 10 upvotes, $0
091. Reflected XSS in scores.ubnt.com to Ubiquiti Inc. - 10 upvotes, $0
092. Multiple XSS in Camptix Event Ticketing Plugin to Ian Dunn - 10 upvotes, $0
093. XSS On meta tags in profile page to GitLab - 10 upvotes, $0
094. Cross-Site Scripting Stored On Rich Media to Pushwoosh - 10 upvotes, $0
095. [uk.informatica.com] XSS on uk.informatica..com to Informatica - 10 upvotes, $0
096. Reflected XSS in U2F plugin by shipping the example endpoints to Nextcloud - 10 upvotes, $0
097. Reflected XSS in login redirection module to Pornhub - 10 upvotes, $0
098. [kb.informatica.com] DOM based XSS in the bindBreadCrumb function to Informatica - 10 upvotes, $0
099. [alpha.informatica.com] Expensive DOMXSS to Informatica - 10 upvotes, $0
100. http://ht.pornhub.com/ stored XSS in widget stylesheet to Pornhub - 10 upvotes, $0
101. Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key= to Starbucks - 10 upvotes, $0
102. Stored XSS in buy topup OLX Gold Credits to OLX - 10 upvotes, $0
103. Stored XSS on player.vimeo.com to Vimeo - 10 upvotes, $0
104. XSS в названии сервера to VK.com - 10 upvotes, $0
105. Simple CSS line-height identifies platform to Tor - 10 upvotes, $0
106. [informatica.com]- Cross Site scripting to Informatica - 10 upvotes, $0
107. Stored XSS Using Media to Automattic - 10 upvotes, $0
108. Stored xss via template injection to WordPress - 10 upvotes, $0
109. reflected xss on cycloferon.health.mail.ru to Mail.ru - 10 upvotes, $0
110. Отраженная XSS на cloud.mail.ru в URL в функционале создания и редактировании презентации. to Mail.ru - 10 upvotes, $0
111. XSS bypass Script execute,Read any file,execute any javascript code--UXSS to Mail.ru - 10 upvotes, $0
112. Reflected XSS on bbe_open_htmleditor_popup.php of BBE Theme via "value"-GET-parameter to LocalTapiola - 10 upvotes, $0
113. Хранимая XSS ( API ) to Mail.ru - 10 upvotes, $0
114. Persistent XSS - Selecting users as allowed merge request approvers to GitLab - 10 upvotes, $0
115. xss - reflected to WordPress - 10 upvotes, $0
116. Improper handling of Chunked data request in sapi_apache2.c leads to Reflected XSS to Internet Bug Bounty - 10 upvotes, $0
117. Reflected Cross Site Scripting (XSS) to Grammarly - 10 upvotes, $0
118. Stored XSS in OAuth redirect URI to Nextcloud - 10 upvotes, $0
119. Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence to Mail.ru - 10 upvotes, $0
120. [http-file-server] Stored XSS in the filename when directories listing to Node.js third-party modules - 10 upvotes, $0
121. Reflected XSS on m.olx.co.id via ad_type parameter to OLX - 10 upvotes, $0
122. Reflected XSS by changing url parameters on the user invite onboarding links. to Polymail, Inc. - 10 upvotes, $0
123. XSS (leads to arbitrary file read in Rocket.Chat-Desktop) to Rocket.Chat - 10 upvotes, $0
124. Reflected XSS with WAF Bypass https://pw.mail.ru to Mail.ru - 10 upvotes, $0
125. Self xss to Nextcloud - 10 upvotes, $0
126. Stored XSS in assets.txmblr.com to Automattic - 10 upvotes, $0
127. Stored XSS on https://apps.topcoder.com/wiki/pages/editpage.action to Topcoder - 10 upvotes, $0
128. Reflected XSS in Nanostation Loco M2 - AirOS ver=6.1.7 to Ubiquiti Inc. - 10 upvotes, $0
129. Cross-site Scripting (XSS) - Reflected to 8x8 - 10 upvotes, $0
130. The vulnerabilities found were XSS, Public disclosure, Network enumeration via CSRF, DLL hijacking. to Zomato - 10 upvotes, $0
131. XSS in image metadata field to Nextcloud - 10 upvotes, $0
132. [panel.city-mobil.ru/admin/] Blind XSS via partner name (similar to #746505) to Mail.ru - 10 upvotes, $0
133. Reflected XSS on https://████/ (Bypass of #1002977) to U.S. Dept Of Defense - 10 upvotes, $0
134. Reflected XSS www.█████ search form to U.S. Dept Of Defense - 10 upvotes, $0
135. Reflected XSS In https://███████ to U.S. Dept Of Defense - 10 upvotes, $0
136. Reflected XSS on https://██████ to U.S. Dept Of Defense - 10 upvotes, $0
137. Reflected XSS through clickjacking at https://████ to U.S. Dept Of Defense - 10 upvotes, $0
138. Cross site scripting to U.S. Dept Of Defense - 10 upvotes, $0
139. CSS injection via link tag whitelisted-domain bypass - https://www.glassdoor.com to Glassdoor - 10 upvotes, $0
140. Stored XSS on the "www.intensedebate.com/extras-widgets" url at "Recent comments by" module with malicious blog url to Automattic - 10
upvotes, $0
141. Account takeover leading to PII chained with stored XSS to U.S. General Services Administration - 10 upvotes, $0
142. Jolokia Reflected XSS to Mars - 10 upvotes, $0
143. [XSS] Reflected XSS via POST request to U.S. Dept Of Defense - 10 upvotes, $0
144. Stored XSS Via NRQL chartbuilder JSON view to New Relic - 9 upvotes, $2500
145. Stored xss in editor to Mapbox - 9 upvotes, $1000
146. XSS в отправителе, БЕТА-версия почты to Mail.ru - 9 upvotes, $500
147. Stored XSS в выборе метки на странице списка заказов. to VK.com - 9 upvotes, $500
148. XSS on opening malicious OpenOffice presentation document to Open-Xchange - 9 upvotes, $400
149. Логи/sql запросы на http://mx36.ucs.ru/ и reflected XSS. to Mail.ru - 9 upvotes, $400
150. Reflected XSS in eform.molpay.com to Razer - 9 upvotes, $375
151. Stored XSS in Template Documents to Open-Xchange - 9 upvotes, $300
152. Reflected XSS in city-mobil.ru/ to Mail.ru - 9 upvotes, $300
153. Persistent XSS on ForecastApp to Harvest - 9 upvotes, $250
154. XSS с помощью специально сформированного файла. to Mail.ru - 9 upvotes, $250
155. XSS на e.mail.ru в мобильном приложении! to Mail.ru - 9 upvotes, $250
156. XSS https://health.mail.ru/my/ через внешнее имя аккаунта to Mail.ru - 9 upvotes, $150
157. XSS via login cookie to Pornhub - 9 upvotes, $100
158. Reflected XSS on www.boozt.com to Boozt Fashion AB - 9 upvotes, $100
159. fix(cmd-socketio-server): mitigate cross site scripting attack #2068 to Hyperledger - 9 upvotes, $100
160. Reflected XSS by way of jQuery function to Pornhub - 9 upvotes, $50
161. Reflected XSS on sankarikoulutus (viestinta.lahitapiola.fi) to LocalTapiola - 9 upvotes, $50
162. Reflected XSS in cart at hardware.shopify.com to Shopify - 9 upvotes, $0
163. XSS onmouseover to Zomato - 9 upvotes, $0
164. [tanks.mail.ru] Internet Explorer XSS via Request-URI to Mail.ru - 9 upvotes, $0
165. [realty.mail.ru] XSS, SSI Injection to Mail.ru - 9 upvotes, $0
166. Reflected XSS on a DoD website to U.S. Dept Of Defense - 9 upvotes, $0
167. Stored XSS on the http://ht.pornhub.com/widgets/ to Pornhub - 9 upvotes, $0
168. [pokerist.mail.ru] XSS Request-URI to Mail.ru - 9 upvotes, $0
169. Reflected cross-site scripting (XSS) vulnerability in scores.ubnt.com allows attackers to inject arbitrary web script via p parameter. to Ubiquiti Inc.
- 9 upvotes, $0
170. Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com] to Informatica - 9 upvotes, $0
171. [platform.harvestapp.com] Reflected XSS in Error Message via URL parameters to Harvest - 9 upvotes, $0
172. XSS to Radancy - 9 upvotes, $0
173. Stored XSS in Adress Book (starbucks.com/account/profile) to Starbucks - 9 upvotes, $0
174. Reflected XSS on business-blog.zomato.com - Part I to Zomato - 9 upvotes, $0
175. Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0) to Concrete CMS - 9 upvotes, $0
176. Stored XSS vulnerability in RSS Feeds Description field to Concrete CMS - 9 upvotes, $0
177. dom based xss in https://www.rockstargames.com/GTAOnline/ to Rockstar Games - 9 upvotes, $0
178. XSS on http://irc.parrotsec.org to Parrot Sec - 9 upvotes, $0
179. Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/ to Ubiquiti Inc. - 9 upvotes, $0
180. Stored XSS in Draft Articles. to Zendesk - 9 upvotes, $0
181. XSS on infogram.com to Infogram - 9 upvotes, $0
182. [public-api.wordpress.com] Stored XSS via Crafted Developer App Description to Automattic - 9 upvotes, $0
183. dom based xss in *.zendesk.com/external/zenbox/ to Zendesk - 9 upvotes, $0
184. Stored XSS => community.ubnt.com to Ubiquiti Inc. - 9 upvotes, $0
185. MediaElements XSS to WordPress - 9 upvotes, $0
186. [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2 to Zomato
- 9 upvotes, $0
187. [statics-server] XSS via injected iframe in file name when statics-server displays directory index in the browser to Node.js third-party modules - 9
upvotes, $0
188. XSS account.mail.ru in state JSON script to Mail.ru - 9 upvotes, $0
189. Persistent XSS via malicious license file to ExpressionEngine - 9 upvotes, $0
190. Stored xss in shop name @ lp.reverb.com to Reverb.com - 9 upvotes, $0
191. Blind XSS pets.mail.ru/admin/ to Mail.ru - 9 upvotes, $0
192. Cross Site Scripting to GoCD - 9 upvotes, $0
193. Stored XSS on Wordpress 5.3 via Title Post to WordPress - 9 upvotes, $0
194. CSS injection in avito.ru via IE11 to Avito - 9 upvotes, $0
195. [webpack-bundle-analyzer] Cross-site Scripting to Node.js third-party modules - 9 upvotes, $0
196. Stored XSS (Hexo-admin plugin) to Node.js third-party modules - 9 upvotes, $0
197. Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMB to Semrush - 9 upvotes, $0
198. xss in ub.icq.net to Mail.ru - 9 upvotes, $0
199. Xss (cross site scripting) on http://axa.dxi.eu/ to 8x8 - 9 upvotes, $0
200. CVE-2019-19935 - DOM based XSS in the froala editor to lemlist - 9 upvotes, $0
201. Reflected XSS on ███████ to U.S. Dept Of Defense - 9 upvotes, $0
202. Reflected-XSS on https://www.topcoder.com/tc via pt parameter to Topcoder - 9 upvotes, $0
203. DOM Based XSS at docs.8x8.com to 8x8 - 9 upvotes, $0
204. Stored XSS on add project to Moneybird - 9 upvotes, $0
205. XSS stored in the Shopify Email app to Shopify - 9 upvotes, $0
206. XSS on https://o2.mail.ru/jsapi/button via PostMessage to Mail.ru - 9 upvotes, $0
207. Reflected XSS on Lark Suite to Lark Technologies - 9 upvotes, $0
208. Reflected XSS at https://████████/███/... to U.S. Dept Of Defense - 9 upvotes, $0
209. ███ on https://████ enable ███ scraping, injection, stored XSS to U.S. Dept Of Defense - 9 upvotes, $0
210. Reflected XSS to U.S. Dept Of Defense - 9 upvotes, $0
211. Reflected XSS on cz.acronis.com/dekujeme-za-odber-novinek-produktu-disk-director with ability to creating an admin user in WordPress to
Acronis - 9 upvotes, $0
212. CSRF Based XSS @ https://██████████ to U.S. Dept Of Defense - 9 upvotes, $0
213. Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS to
Kubernetes - 9 upvotes, $0
214. In orginization stored xss using location (Larksuite survey app) to Lark Technologies - 9 upvotes, $0
215. Stored XSS in Question edit for product name (bypass #1416672) to Judge.me - 9 upvotes, $0
216. Reflected XSS on [█████████] to U.S. Dept Of Defense - 9 upvotes, $0
217. Site information's Display Name section vulnerable for XSS attacks and HTML Injections. to Automattic - 9 upvotes, $0
218. Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS to Brave Software - 9 upvotes, $0
219. Reflected XSS on https://wwwapps.ups.com/ctc/request?loc= to UPS VDP - 9 upvotes, $0
220. Cross Site Scripting Vulnerability in fabric-sdk-py source code to Hyperledger - 9 upvotes, $0
221. Reflected XSS in chatbot to MTN Group - 9 upvotes, $0
222. Moodle XSS on s-immerscio.comprehend.ibm.com to IBM - 9 upvotes, $0
223. XSS via Vuln Rendertron Instance At ██████████.jetblue.com/render/* to JetBlue - 9 upvotes, $0
224. Reflected XSS via Unvalidated / Open Redirect in uber.com to Uber - 8 upvotes, $3000
225. shopifyapps.com XSS on sales channels via currency formatting to Shopify - 8 upvotes, $1000
226. pornhub.com/user/welcome/basicinfo nickname field is vulnerable on xss to Pornhub - 8 upvotes, $750
227. a stored xss issue in https://files.slack.com to Slack - 8 upvotes, $500
228. OX Guard: DOM Based Cross-Site Scripting to Open-Xchange - 8 upvotes, $500
229. [account.mail.ru] XSS на странице удаления аккаунта через backUrl to Mail.ru - 8 upvotes, $500
230. XSS - Calendar - Unescaped common name of appointment participant to Open-Xchange - 8 upvotes, $450
231. Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover to EXNESS - 8 upvotes, $300
232. Stored Xss to Mail.ru - 8 upvotes, $200
233. Multiple Reflected XSS /webApp/lahti (viestinta.lahitapiola.fi) to LocalTapiola - 8 upvotes, $150
234. Stored XSS in wis.pr to Whisper - 8 upvotes, $100
235. Stored XSS Found to Slack - 8 upvotes, $0
236. Cross site scripting to Mail.ru - 8 upvotes, $0
237. Stored XSS On Statement to Gratipay - 8 upvotes, $0
238. Reflected XSS on Uber.com careers to Uber - 8 upvotes, $0
239. Stored XSS via Angular Expression injection on developer.zendesk.com to Zendesk - 8 upvotes, $0
240. Stored Cross site scripting to Zomato - 8 upvotes, $0
241. [odnoklassniki.ru] XSS via Host to Mail.ru - 8 upvotes, $0
242. Reflected XSS in www.olx.ph to OLX - 8 upvotes, $0
243. Self-XSS via location cookie city field when getting suggestions for a new location to Yelp - 8 upvotes, $0
244. [rubm.qiwi.com] Yui charts.swf XSS to QIWI - 8 upvotes, $0
245. Reflected Xss in AirMax [Nanostation Loco M2] to Ubiquiti Inc. - 8 upvotes, $0
246. Reflected XSS in a Navy website to U.S. Dept Of Defense - 8 upvotes, $0
247. Reflected XSS on an Army website to U.S. Dept Of Defense - 8 upvotes, $0
248. Reflected XSS on a Department of Defense website to U.S. Dept Of Defense - 8 upvotes, $0
249. Reflected XSS on a Department of Defense website to U.S. Dept Of Defense - 8 upvotes, $0
250. [marketplace.informatica.com] Persistent XSS through document title to Informatica - 8 upvotes, $0
251. Reflected XSS vector to GoCD - 8 upvotes, $0
252. [XSS/3dsecure.qiwi.com] 3DSecure XSS to QIWI - 8 upvotes, $0
253. a stored xss in web widget chat to Zendesk - 8 upvotes, $0
254. XSS on a DoD website to U.S. Dept Of Defense - 8 upvotes, $0
255. [parc.informatica.com] Reflected Cross Site Scripting and Open Redirect to Informatica - 8 upvotes, $0
256. XSS via SVG file to Ubiquiti Inc. - 8 upvotes, $0
257. Markdown based stored XSS (IE only) to GitLab - 8 upvotes, $0
258. XSS to Ubiquiti Inc. - 8 upvotes, $0
260. Flash XSS on homepage fliptilescroller to General Motors - 8 upvotes, $0
261. Xss on billing to QIWI - 8 upvotes, $0
262. Stored but [SELF] XSS in mercantile.wordpress.org to WordPress - 8 upvotes, $0
263. Cross-site scripting (XSS) vulnerability on a DoD website to U.S. Dept Of Defense - 8 upvotes, $0
264. Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains
payload to Concrete CMS - 8 upvotes, $0
265. XSS on Nanostation Loco M2 Airmax to Ubiquiti Inc. - 8 upvotes, $0
266. Unauthenticated Cross-Site Scripting in Web Management Console to Ubiquiti Inc. - 8 upvotes, $0
267. Reflective XSS to WebSummit - 8 upvotes, $0
268. Self-XSS in WordPress Editor Link Modal to WordPress - 8 upvotes, $0
269. Stored Cross-Site scripting in the infographics using links to Infogram - 8 upvotes, $0
270. XSS when replying / forwarding to a malicious email on iOS to Mail.ru - 8 upvotes, $0
271. self-xss ads_easy_promote vk.com to VK.com - 8 upvotes, $0
272. XSS on account.mail.ru/login to Mail.ru - 8 upvotes, $0
273. DOM-based Cross-Site Scripting in redirect url checkout to RBKmoney - 8 upvotes, $0
274. [simplehttpserver] Stored XSS in file names leads to malicious JavaScript code execution when directory listing is output in HTML to Node.js
third-party modules - 8 upvotes, $0
275. XSS through document projects to Khan Academy - 8 upvotes, $0
276. [bracket-template] Reflected XSS possible when variable passed via GET parameter is used in template to Node.js third-party modules - 8
upvotes, $0
277. Your page has 2 blocking CSS resources. This causes a delay in rendering your page. to Node.js - 8 upvotes, $0
278. XSS (Persistent) - Selecting role(s) for protected branches to GitLab - 8 upvotes, $0
279. XSS on support.wordcamp.org in ajax-quote.php to WordPress - 8 upvotes, $0
280. X-XSS-Protection header has not been set at app.passit.io to Passit - 8 upvotes, $0
281. Stored self-xss and its escalation to a victim account in e.mail.ru to Mail.ru - 8 upvotes, $0
282. XSS in delivery club to Mail.ru - 8 upvotes, $0
283. Stored XSS against all Chaturbate users using an application name to Chaturbate - 8 upvotes, $0
284. Cross site scripting (content-sniffing) to Khan Academy - 8 upvotes, $0
285. Reflected cross site scripting at https://auto.mail.ru/reviews/add_review/ via problems_text parameter. to Mail.ru - 8 upvotes, $0
286. XSS при загрузке изображения на [games.mail.ru] to Mail.ru - 8 upvotes, $0
287. Hidden Stored XSS in nested post embeds to Vanilla - 8 upvotes, $0
288. [███] SQL injection & Reflected XSS to U.S. Dept Of Defense - 8 upvotes, $0
289. The URL in "Choose a data source'' at "https://bi.owox.com/ui/settings/connected-services/setup/" is not filtered => reflected XSS. to OWOX,
Inc. - 8 upvotes, $0
290. [atlasboard-atlassian-package] Cross-site Scripting (XSS) to Node.js third-party modules - 8 upvotes, $0
291. XSS via HTTP request version in account.my.games to Mail.ru - 8 upvotes, $0
292. xss on bittorrent.com to BTFS - 8 upvotes, $0
293. Post based XSS (Cross site scripting) on https://apimgr.8x8.com to 8x8 - 8 upvotes, $0
294. Stored XSS at Synthetics private locations (planted through location label or description) to New Relic - 8 upvotes, $0
295. Stored XSS via Comment Form at ████████ to U.S. Dept Of Defense - 8 upvotes, $0
296. DOM XSS on https://www.███████ to U.S. Dept Of Defense - 8 upvotes, $0
297. XSS on kubernetes-csi.github.io (mdBook) to Kubernetes - 8 upvotes, $0
299. Dom XSS Rootkit on [https://www.glassdoor.com/] to Glassdoor - 8 upvotes, $0
300. Reflected XSS at www.███████ at /██████████ via the ████████ parameter to U.S. Dept Of Defense - 8 upvotes, $0
301. Stored unauth XSS in calendar event via CSRF to Concrete CMS - 8 upvotes, $0
302. Blind XSS to Rocket.Chat - 8 upvotes, $0
303. Cross-site Scripting (XSS) - Reflected at https://██████████/ to U.S. Dept Of Defense - 8 upvotes, $0
304. Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag to Ruby on Rails - 8 upvotes, $0
305. Reflected xss on videostore.mtnonline.com to MTN Group - 8 upvotes, $0
306. SSRF & XSS (W3 Total Cache) to Pornhub - 7 upvotes, $1000
307. touch.mail.ru/messages - Stored XSS to Mail.ru - 7 upvotes, $750
308. VERY DANGEROUS XSS STORED inside emails to Mail.ru - 7 upvotes, $600
309. "a stored xss issue in share post menu" to Slack - 7 upvotes, $500
310. Stored XSS in Email attachment file name to Open-Xchange - 7 upvotes, $500
311. XSS - Guard - Insufficient escaping of User-IDs from PGP Keys to Open-Xchange - 7 upvotes, $500
312. Stored XSS on recruit.innogames.de to InnoGames - 7 upvotes, $500
313. XSS on opening malicious OpenOffice presentation document to Open-Xchange - 7 upvotes, $400
314. PornIQ Reflected Cross-Site Scripting to Pornhub - 7 upvotes, $250
315. [connect.mail.ru] Memory Disclosure / IE XSS to Mail.ru - 7 upvotes, $250
316. Stored XSS and html injection in biz.mail.ru to Mail.ru - 7 upvotes, $250
317. DOM based XSS via postMessage at store.my.games to Mail.ru - 7 upvotes, $200
318. XSS PoC for the wacky.buggywebsite.com challenge to BugPoC - 7 upvotes, $100
319. XSS in Draft Orders in Timeline i SHOPIFY Admin Site! to Shopify - 7 upvotes, $0
320. Adobe XSS to Adobe - 7 upvotes, $0
321. Reflected XSS in Gallery App to Nextcloud - 7 upvotes, $0
322. XSS and open redirect in verkkopalvelu.lahitapiola.fi to LocalTapiola - 7 upvotes, $0
323. Reflected XSS on a Navy website to U.S. Dept Of Defense - 7 upvotes, $0
324. Application XSS filter function Bypass may allow Multiple stored XSS to Vimeo - 7 upvotes, $0
325. XSS on Meta Tag at https://m.olx.ph to OLX - 7 upvotes, $0
326. [RDoc] XSS in project README files to GitLab - 7 upvotes, $0
327. [reStructuredText] XSS in project README files to GitLab - 7 upvotes, $0
328. CSRF bypass + XSS on verkkopalvelu.tapiola.fi to LocalTapiola - 7 upvotes, $0
329. Reflected XSS vulnerability on a DoD website to U.S. Dept Of Defense - 7 upvotes, $0
330. Stored XSS thru SVG upload to Moneybird - 7 upvotes, $0
331. Stored xss in agent.qiwi.com to QIWI - 7 upvotes, $0
332. Stored passive XSS at scheduled posts (kitcrm.com) to Shopify - 7 upvotes, $0
333. [kb.informatica.com] Stored XSS to Informatica - 7 upvotes, $0
334. XSS on IOS app via HTML rendering to Nextcloud - 7 upvotes, $0
335. Stored XSS in Express Objects - Concrete5 v8.1.0 to Concrete CMS - 7 upvotes, $0
336. xss на нескольких форумах игр от mail.ru (Cross-Site Scripting) to Mail.ru - 7 upvotes, $0
337. [compose.mixmax.com] Stored XSS on compose.mixmax.com in contact names. to Mixmax - 7 upvotes, $0
338. Stored XSS in Templates>Enahance>Social Badges to Mixmax - 7 upvotes, $0
339. Stored XSS on Admin Access Page - Email field to Revive Adserver - 7 upvotes, $0
340. Stored XSS in Name field in User Groups/Group Details form to Concrete CMS - 7 upvotes, $0
341. XSS on vimeo.com | "Search within these results" feature (requires user interaction) to Vimeo - 7 upvotes, $0
342. XSS when using captions/subtitles on video player based on Flash (requires user interaction) to Vimeo - 7 upvotes, $0
343. xss flash on http://presentatie.werkenbijmcdonalds.nl/ to Radancy - 7 upvotes, $0
344. Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap] to Concrete CMS - 7 upvotes, $0
345. Stored XSS in content when Graph is created via API to Infogram - 7 upvotes, $0
346. Stored XSS using SVG on subdomain infra.mail.ru to Mail.ru - 7 upvotes, $0
347. Stored Cross-Site scripting in the infographics using Data Objects links to Infogram - 7 upvotes, $0
348. X-XSS-Protection -> Misconfiguration to U.S. Dept Of Defense - 7 upvotes, $0
349. XSS работающая по всему сайту, где есть упоминания to VK.com - 7 upvotes, $0
350. XSS in api_v1 to FormAssembly - 7 upvotes, $0
351. Reflected Cross-site Scripting Vulnerability via JSON Error Message to Inflection - 7 upvotes, $0
352. [metascraper] Stored XSS in Open Graph meta properties read by metascrapper to Node.js third-party modules - 7 upvotes, $0
353. Flash-based XSS on mediaelement-flash-audio-ogg.swf of www.lahitapiolarahoitus.fi to LocalTapiola - 7 upvotes, $0
354. XSS on e.mail.ru via postMessage to Mail.ru - 7 upvotes, $0
355. XSS at https://icq.com/people to Mail.ru - 7 upvotes, $0
356. XSS in OLX.pl ("title" in new advertisement) to OLX - 7 upvotes, $0
357. Stored XSS in Node-Red to Node.js third-party modules - 7 upvotes, $0
358. XSS e.mail.ru fixSpecialSymbols to Mail.ru - 7 upvotes, $0
359. XSS via Cookie in e.mail.ru to Mail.ru - 7 upvotes, $0
360. Stored XSS on Add Event in Calendar to Concrete CMS - 7 upvotes, $0
361. Stored XSS on Add Calendar to Concrete CMS - 7 upvotes, $0
362. Stored 'undefined' Cross-site Scripting to Khan Academy - 7 upvotes, $0
363. Reflected XSS on ssl-ccstatic.highwebmedia.com via player.swf to Chaturbate - 7 upvotes, $0
364. Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7) to GitLab - 7 upvotes, $0
365. Хранимая XSS в пожертованиях на dobro.mail.ru to Mail.ru - 7 upvotes, $0
366. Browser Self XSS Protection not implemented to Weblate - 7 upvotes, $0
367. Reflected xss in Serendipity's /index.php to Hanno's projects - 7 upvotes, $0
368. Reflected XSS in delivery-club.ru to Mail.ru - 7 upvotes, $0
369. Stored XSS in profile page to Vercel - 7 upvotes, $0
370. XSS Reflect to TomTom - 7 upvotes, $0
371. Stored XSS @ /engage/<project_slug> to Weblate - 7 upvotes, $0
372. Corda Server XSS ████████ to U.S. Dept Of Defense - 7 upvotes, $0
373. [https://fleet.city-mobil.ru] Stored XSS into driver mailing to Mail.ru - 7 upvotes, $0
374. Stored XSS in the file search filter to Concrete CMS - 7 upvotes, $0
375. DOM based Cross-site Scripting to BugPoC - 7 upvotes, $0
376. Stored XSS at Mobile (Versions tab) to New Relic - 7 upvotes, $0
377. Passive stored XSS at Synthetics job result page (View resource) to New Relic - 7 upvotes, $0
378. REFLECTED XSS On http://jsgames.mail.ru/bad_browser.php via back_url paramter to Mail.ru - 7 upvotes, $0
379. Cross Site Scripting (XSS) – Reflected to U.S. Dept Of Defense - 7 upvotes, $0
380. the same as #948259 - XSS at jsgames.mail.ru to Mail.ru - 7 upvotes, $0
381. Reflected XSS on https://█████████html?url to U.S. Dept Of Defense - 7 upvotes, $0
382. capsula.mail.ru - reflected xss to Mail.ru - 7 upvotes, $0
383. Reflected XSS on /admin/campaign-zone-zones.php to Revive Adserver - 7 upvotes, $0
384. Reflected XSS on ███████ to U.S. Dept Of Defense - 7 upvotes, $0
385. [Swiftype] - Stored XSS via document field url triggers on https://app.swiftype.com/engines/\<engine\>/document_types/\
<type\>/documents/\<id\> to Elastic - 7 upvotes, $0
386. XSS on ███ to U.S. Dept Of Defense - 7 upvotes, $0

387. XSS on ub.icq.net to Mail.ru - 7 upvotes, $0
388. XW 6.2.0 firmware: 5 Reflected XSS issues in link.cgi to Ubiquiti Inc. - 7 upvotes, $0
389. XSS to Reddit - 7 upvotes, $0
390. Dom Xss vulnerability to Recorded Future - 7 upvotes, $0
391. Open Akamai ARL XSS at ████████ to U.S. Dept Of Defense - 7 upvotes, $0
392. Open Akamai ARL XSS at ████████ to U.S. Dept Of Defense - 7 upvotes, $0
393. XSS in redditmedia.com can compromise data of reddit.com to Reddit - 7 upvotes, $0
394. Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style) to Ruby on Rails - 7 upvotes, $0
395. stored cross site scripting in https://███ to U.S. Dept Of Defense - 7 upvotes, $0
396. Reflected XSS at ████████ to U.S. Dept Of Defense - 7 upvotes, $0
397. Reflected XSS in ██████ to U.S. Dept Of Defense - 7 upvotes, $0
398. DOM-XSS to U.S. Dept Of Defense - 7 upvotes, $0
399. Stored XSS in drive.uber.com WordPress admin panel to Uber - 6 upvotes, $2000
400. Stored-XSS with user interaction on [sandbox.open-xchange.com] via inserted link in mail to Open-Xchange - 6 upvotes, $500
401. Persistent XSS: Editor link to Phabricator - 6 upvotes, $300
402. Reflected XSS in Meta Tag to Pornhub - 6 upvotes, $250
403. Reflected XSS Vulnerability in https://www.lahitapiola.fi/cs/Satellite to LocalTapiola - 6 upvotes, $250
404. XSS в портальной навигации to Mail.ru - 6 upvotes, $150
405. XSS to Boozt Fashion AB - 6 upvotes, $120
406. Stored XSS in name selection to Algolia - 6 upvotes, $100
407. Reflected XSS in LTContactFormReceiver (/cs/Satellite) to LocalTapiola - 6 upvotes, $50
408. XSS at http://smarthistory.khanacademy.org to Khan Academy - 6 upvotes, $0
409. XSS & HTML injection to Localize - 6 upvotes, $0
410. XSS in invite approval to Localize - 6 upvotes, $0
411. XSS in main page to Localize - 6 upvotes, $0
412. XSS in private message to Concrete CMS - 6 upvotes, $0
413. Stored XSS in www.slack-files.com to Slack - 6 upvotes, $0
414. Here is another XSS i got for you to MoneyStream - 6 upvotes, $0
415. Cross site scripting on ads.twitter.com to X (Formerly Twitter) - 6 upvotes, $0
416. XSS by image file name to FanFootage - 6 upvotes, $0
417. Persistent XSS on public project page to GitLab - 6 upvotes, $0
418. Stored XSS in Financial Account executing in Bank tab to Moneybird - 6 upvotes, $0
419. Stored Cross Site Scripting [SELF] in partners.uber.com to Uber - 6 upvotes, $0
420. Stored XSS in comments to Paragon Initiative Enterprises - 6 upvotes, $0
421. xss in group to ok.ru - 6 upvotes, $0
422. XSS @ *.olx.com.ar to OLX - 6 upvotes, $0
423. XSS yaman.olx.ph to OLX - 6 upvotes, $0
424. Additonal stored XSS in Add note/Expected payment Date to Xero - 6 upvotes, $0
425. XSS in the "Poll" Feature on Twitter.com to X (Formerly Twitter) - 6 upvotes, $0
426. newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf to Uber - 6 upvotes, $0
427. Stored XSS triggered by json key during UI generation to Algolia - 6 upvotes, $0
428. XSS on Home page olx.com.ar via auto save search text to OLX - 6 upvotes, $0
429. Reflective XSS at m.olx.ph to OLX - 6 upvotes, $0
430. [now.informatica.com] Reflective Xss to Informatica - 6 upvotes, $0
431. Stored XSS in Filters to Pushwoosh - 6 upvotes, $0
432. Public profile is vulnerable to stored XSS / Facebook Token can be stolen to DigitalSellz - 6 upvotes, $0
433. Reflected XSS in [olx.qa] to OLX - 6 upvotes, $0
435. Reflected XSS on frag.mail.ru to Mail.ru - 6 upvotes, $0
436. [network.informatica.com] The login form XSS via the referer value to Informatica - 6 upvotes, $0
437. Reflected XSS in a DoD Website to U.S. Dept Of Defense - 6 upvotes, $0
438. Reflected XSS in Zomato Mobile - category parameter to Zomato - 6 upvotes, $0
439. Reflected XSS on Zones > Invocation Code to Revive Adserver - 6 upvotes, $0
440. XSS on mobile version of vimeo.com where the button "Follow" appears to Vimeo - 6 upvotes, $0
441. XSS в комментариях от имени сообщества to VK.com - 6 upvotes, $0
442. XSS during presentation to Zaption - 6 upvotes, $0
443. XSS when Shared to Infogram - 6 upvotes, $0
444. Multiple xss on infogram templates to Infogram - 6 upvotes, $0
445. Stored XSS On Wordpress Infogram plugin to Infogram - 6 upvotes, $0
446. Persistent Cross-Site Scripting in WooCommerce WordPress plugin to Automattic - 6 upvotes, $0
447. Persistent XSS in share button to Infogram - 6 upvotes, $0
448. [marketplace.informatica.com]-Reflected XSS to Informatica - 6 upvotes, $0
449. Хранимая XSS на странице "Виджет для авторизации" to VK.com - 6 upvotes, $0
450. [uppy] Stored XSS due to crafted SVG file to Node.js third-party modules - 6 upvotes, $0
451. XSS уязвимость to Mail.ru - 6 upvotes, $0
452. Stored Cross Site Scripting to Y Combinator - 6 upvotes, $0
453. XSS touch.mail.ru compose Body to Mail.ru - 6 upvotes, $0
454. XSS ( Работа с письмами ) to Mail.ru - 6 upvotes, $0
455. [tianma-static] Stored xss on filename to Node.js third-party modules - 6 upvotes, $0
456. [hs.mail.ru] XSS play_now.php to Mail.ru - 6 upvotes, $0
457. [hs.mail.ru] CRLF Injection / XSS to Mail.ru - 6 upvotes, $0
458. [new.wf.mail.ru] XSS Request-URI to Mail.ru - 6 upvotes, $0
459. [evo2.my.com] Internet Explorer XSS to Mail.ru - 6 upvotes, $0
460. [█████] Reflected GET XSS (/personnel.php?...&rcnum=*) with mouse action to U.S. Dept Of Defense - 6 upvotes, $0
461. Reflected XSS on card.starbucks.com.sg/unsub.php via the 'ct' Parameter to Starbucks - 6 upvotes, $0
462. Double linking cause XSS (but blokeced by CSP in gitlab.com) to GitLab - 6 upvotes, $0
463. XSS на сайте https://warofdragons.my.games/. to Mail.ru - 6 upvotes, $0
464. [reveal.js] XSS by calling arbitrary method via postMessage to Node.js third-party modules - 6 upvotes, $0
465. xss to Stellar.org - 6 upvotes, $0
466. XSS on remote.bittorrent.com to BTFS - 6 upvotes, $0
467. Stored XSS on go.mail.ru to Mail.ru - 6 upvotes, $0
468. DOM based XSS on /GTAOnline/de/news/article via "returnUrl" parameter to Rockstar Games - 6 upvotes, $0
469. Stored XSS at ██████userprofile.aspx to U.S. Dept Of Defense - 6 upvotes, $0
470. Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters to Starbucks - 6 upvotes, $0
471. [notevil] - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser to Node.js third-party modules - 6 upvotes, $0
472. [self?] XSS в адресе пользователя [sbermarket.ru] to Mail.ru - 6 upvotes, $0
473. [delivery.city-mobil.ru] Stored XSS into support request comment to Mail.ru - 6 upvotes, $0
474. Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'. to Stripo Inc - 6 upvotes, $0
475. [BugPOC and Amazon XSS CTF writeup] A CSP Bypass Story to BugPoC - 6 upvotes, $0
476. [aw.mail.ru] XSS on /quiztank page to Mail.ru - 6 upvotes, $0
477. Stored XSS at https://www.█████████.mil to U.S. Dept Of Defense - 6 upvotes, $0
478. Stored XSS via 64(?) vulnerable fields in ███ leads to credential theft/account takeover to U.S. Dept Of Defense - 6 upvotes, $0
479. [MY.GAMES] XSS в мессенджере to Mail.ru - 6 upvotes, $0
480. Second Order XSS via █████ to U.S. Dept Of Defense - 6 upvotes, $0
481. Reflected XSS on █████████ to U.S. Dept Of Defense - 6 upvotes, $0
482. DOM XSS в learning.ozon.ru to Ozon - 6 upvotes, $0
483. XSS reflected to Engel & Völkers Technology GmbH - 6 upvotes, $0
484. [www.███] Reflected Cross-Site Scripting to U.S. Dept Of Defense - 6 upvotes, $0
485. Stored-XSS in merge requests to GitLab - 6 upvotes, $0
486. ███████ - XSS - CVE-2020-3580 to U.S. Dept Of Defense - 6 upvotes, $0
487. Open Redirect and CRLF Injection Leads to XSS on [app.doma.uchi.ru] to Mail.ru - 6 upvotes, $0
488. Reflected XSS at https://█████ via "██████████" parameter to U.S. Dept Of Defense - 6 upvotes, $0
489. Stored XSS in Question edit from product name to Judge.me - 6 upvotes, $0
490. XSS on https://████/ via ███████ parameter to U.S. Dept Of Defense - 6 upvotes, $0
491. XSS at http://nextapps.mtnonline.com/search/suggest/q/{xss payload} to MTN Group - 6 upvotes, $0
492. Reflected XSS via ████████ parameter to U.S. Dept Of Defense - 6 upvotes, $0
493. Cross-site scripting (DOM-based) to OneWeb - 6 upvotes, $0
494. [doc.rt.informaticacloud.com] Reflected XSS via Stack Strace to Informatica - 6 upvotes, $0
495. XSS DUE TO CVE-2022-38463 in https://████████ to U.S. Dept Of Defense - 6 upvotes, $0
496. XSS in Acronis Cloud Manager Admin Portal to Acronis - 6 upvotes, $0
497. stored cross site scripting in https://██████████ to U.S. Dept Of Defense - 6 upvotes, $0
498. Stored XSS in archive.uber.com Due to Injection of Javascript:alert(0) to Uber - 5 upvotes, $3000
499. Reflected XSS via Livefyre Media Wall in newsroom.uber.com to Uber - 5 upvotes, $2000
500. [h1-2102] Stored XSS in product description via productUpdate GraphQL query leads to XSS at handshake-web-
internal.shopifycloud.com/products/[ID] to Shopify - 5 upvotes, $1600
501. Persistent cross-site scripting (XSS) in map attribution to Mapbox - 5 upvotes, $1000
502. XSS on internal: privileged origin through reader mode to Brave Software - 5 upvotes, $500
503. Reflected cross-site scripting (XSS) vulnerability in pornhub.com allows attackers to inject arbitrary web script or HTML. to Pornhub - 5 upvotes,
$200
504. Store Cross-Site Scripting - www.razer.ru to Razer - 5 upvotes, $200
505. XSS на странице "Платежи водителей" [city-mobil.ru/taxiserv] to Mail.ru - 5 upvotes, $150
506. Stored XSS at Udemy to Udemy - 5 upvotes, $50
507. Cross Site Scripting – Album Page to Pornhub - 5 upvotes, $50
508. Stored XSS from ticket messages in admin table in SupportFlow to Ian Dunn - 5 upvotes, $50
509. Stored XSS in SupportFlow Ticket Subject to Ian Dunn - 5 upvotes, $50
510. XSS in Groups to Localize - 5 upvotes, $0
511. Stored XSS in Slackbot Direct Messages to Slack - 5 upvotes, $0
512. XSS 1 to StopTheHacker - 5 upvotes, $0
513. reflected XSS, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringClean to Yahoo! - 5 upvotes, $0
514. XSS on [/concrete/concrete/elements/dashboard/sitemap.php] to Concrete CMS - 5 upvotes, $0
515. Stored XSS on this link https://sehacure.slack.com/help/requests/ to Slack - 5 upvotes, $0
516. Reflected XSS connect.mail.ru (IE6-IE8) to Mail.ru - 5 upvotes, $0
517. XSS on any site that includes the moogaloop flash player | deprecated embed code to Vimeo - 5 upvotes, $0
518. Tweet Deck XSS- Persistent- Group DM name to X (Formerly Twitter) - 5 upvotes, $0
519. Potential XSS on sanitize/Rails::Html::WhiteListSanitizer to Ruby on Rails - 5 upvotes, $0
520. XSS via React element spoofing to Imgur - 5 upvotes, $0
521. XSS on hardware.shopify.com to Shopify - 5 upvotes, $0
522. XSS via Fabrico Account Name to X (Formerly Twitter) - 5 upvotes, $0
523. Several XSS affecting Zomato.com and developers.zomato.com to Zomato - 5 upvotes, $0
524. Cross Site Scripting In Profile Statement to Gratipay - 5 upvotes, $0
525. refelected Xss on https://gmid.gm.com/gmid/jsp/GMIDInitialLogin.jsp to General Motors - 5 upvotes, $0
526. XSS in https://www.coursera.org/courses/ to Coursera - 5 upvotes, $0
527. DOM XSS в /activation.php?act=activate_mobile to VK.com - 5 upvotes, $0
528. Xss in m.ok.ru to ok.ru - 5 upvotes, $0
529. [mrgs.mail.ru] Internet Explorer XSS via Request-URI to Mail.ru - 5 upvotes, $0
530. Stored XSS on contact name to OLX - 5 upvotes, $0
531. Reflected XSS at m.olx.ph to OLX - 5 upvotes, $0
532. [now.informatica.com] Reflective XSS to Informatica - 5 upvotes, $0
533. XSS vulnerability on an Army website to U.S. Dept Of Defense - 5 upvotes, $0
534. Wordpress flashmediaelement.swf XSS on stopthehacker.com to StopTheHacker - 5 upvotes, $0
535. Stored XSS in albums on http://m.imgur.com/ to Imgur - 5 upvotes, $0
536. [Textile] XSS in project README files to GitLab - 5 upvotes, $0
537. Reflected XSS on Signup Page to New Relic - 5 upvotes, $0
538. Stored XSS в имени песни (2) на платёжном гейте. to ok.ru - 5 upvotes, $0
539. [allods.mail.ru] Reflected XSS to Mail.ru - 5 upvotes, $0
540. Reflected XSS in olx.pt to OLX - 5 upvotes, $0
541. [careers.informatica.com] XSS on "isJTN" to Informatica - 5 upvotes, $0
542. [marketplace.informatica.com]- Stored XSS on Image title and Edit Property to Informatica - 5 upvotes, $0
543. [marketplace.informatica.com] Search XSS to Informatica - 5 upvotes, $0
544. self xss in to Quora - 5 upvotes, $0
545. Self-XSS can be achieved in the editor link using filter bypass to Weblate - 5 upvotes, $0
546. Reflected XSS on Branch domain to Cuvva - 5 upvotes, $0
547. Reflected XSS and something more Store XSS too to General Motors - 5 upvotes, $0
548. Flash XSS on global nav to General Motors - 5 upvotes, $0
550. Reflected XSS on business-blog.zomato.com - Part 2 to Zomato - 5 upvotes, $0
551. Reflected cross-site scripting (XSS) vulnerability on a DoD website to U.S. Dept Of Defense - 5 upvotes, $0
552. Cross-site Scripting (XSS) in /updates-pro/archive/ to MapsMarker.com e.U. - 5 upvotes, $0
553. Reflected XSS на https://aw.mail.ru/news/ to Mail.ru - 5 upvotes, $0
554. Reflected XSS in Step 2 of the Installation to Revive Adserver - 5 upvotes, $0
555. XSS on player.vimeo.com without user interaction and vimeo.com with user interaction to Vimeo - 5 upvotes, $0
556. Reflected XSS on vimeo.com/musicstore to Vimeo - 5 upvotes, $0
557. Reflected XSS on www.bookfresh.com/index.html?view=upload_form to Bookfresh - 5 upvotes, $0
558. XSS on Report Classic to Infogram - 5 upvotes, $0
559. Stored XSS via transloadit.com and imageproxy to Coursera - 5 upvotes, $0
560. Report Design Critical Stored DOM XSS Vulnerability to Infogram - 5 upvotes, $0
561. [marketplace.informatica.com] - Stored XSS to Informatica - 5 upvotes, $0
562. muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint to Uber - 5
upvotes, $0
563. [html-janitor] Passing user-controlled data to clean() leads to XSS to Node.js third-party modules - 5 upvotes, $0
564. Reflected XSS { support.mycrypto.com } to MyCrypto - 5 upvotes, $0
565. Outdated MediaElement.js Reflected Cross-Site Scripting (XSS) to Zomato - 5 upvotes, $0
566. [public] Stored XSS in filenames in directory served by public to Node.js third-party modules - 5 upvotes, $0
567. [maps.me] Reflected XSS to Mail.ru - 5 upvotes, $0
568. The react-marked-markdown module allows XSS injection in href values. to Node.js third-party modules - 5 upvotes, $0
569. [public] Stored XSS in the filename when directories listing to Node.js third-party modules - 5 upvotes, $0
570. [html-pages] Stored XSS in the filename when directories listing to Node.js third-party modules - 5 upvotes, $0
571. stored xss in scrape-metadata when reading metadata from an html page to Node.js third-party modules - 5 upvotes, $0
572. XSS (stored) Wizard is saving executable code to Rocket.Chat - 5 upvotes, $0
573. XSS in http://localhost:8153/go/admin/config/server/update to GoCD - 5 upvotes, $0
574. Stored XSS in Profile Comments to Vanilla - 5 upvotes, $0
575. Remote File Inclusion, Malicious File Hosting, and Cross-site Scripting (XSS) in ████████ to U.S. Dept Of Defense - 5 upvotes, $0
576. Lack of input validation and sanitization in react-autolinker-wrapper library causes XSS to Node.js third-party modules - 5 upvotes, $0
577. HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0 to Nextcloud - 5 upvotes, $0
578. [share.polymail.io] XSS when uploading a file to the server to Polymail, Inc. - 5 upvotes, $0
579. Stored XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action to Topcoder - 5 upvotes, $0
580. Reflected XSS on https://apps.topcoder.com/wiki/pages/createpage.action to Topcoder - 5 upvotes, $0
581. Reflected XSS and HTML Injectionon a DoD website to U.S. Dept Of Defense - 5 upvotes, $0
582. Dom based XSS on www.rockstargames.com/GTAOnline/features/freemode to Rockstar Games - 5 upvotes, $0
583. Stored XSS on express entries to Concrete CMS - 5 upvotes, $0
584. Stored XSS on Company Logo to 8x8 - 5 upvotes, $0
585. Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search" to Mail.ru - 5 upvotes, $0
586. xss on [storehouse5.ucs.ru] to Mail.ru - 5 upvotes, $0
587. Stored XSS at APM transaction map (transactionName field) to New Relic - 5 upvotes, $0
588. XSS via "gp" cookie reflected in source code to Mail.ru - 5 upvotes, $0
589. xss on polaris.shopify.com/demo using postMessage to Shopify - 5 upvotes, $0
590. Arbitrary file upload and stored XSS via ███ support request to U.S. Dept Of Defense - 5 upvotes, $0
591. HTML Injection + XSS Vulnerability - https://████████/ | Proof of Concept [PoC] to U.S. Dept Of Defense - 5 upvotes, $0
592. Blind Stored XSS on https://█████████ after filling a request at https://█████ to U.S. Dept Of Defense - 5 upvotes, $0
593. reflected xss @ www.█████████ to U.S. Dept Of Defense - 5 upvotes, $0
594. Reflected XSS in https://██████████ via "████████" parameter to U.S. Dept Of Defense - 5 upvotes, $0
595. Cross-site Scripting (XSS) possible at https://sifchain.finance// via CVE-2019-8331 exploitation to Sifchain - 5 upvotes, $0
596. CSS-Reflected to Engel & Völkers Technology GmbH - 5 upvotes, $0
597. [█████████] Reflected Cross-Site Scripting Vulnerability to U.S. Dept Of Defense - 5 upvotes, $0
599. Stored XSS on https://community.my.games/ (Add Post) to Mail.ru - 5 upvotes, $0
600. 8x8pilot.com: Reflected XSS in Apache Tomcat /jsp-examples example directory to 8x8 - 5 upvotes, $0
601. Reflected XSS on https://www.glassdoor.com/parts/header.htm to Glassdoor - 5 upvotes, $0
602. Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass] to Acronis - 5 upvotes, $0
603. Shop - Reflected XSS With Clickjacking Leads to Steal User's Cookie In Two Domain to Meredith - 5 upvotes, $0
604. Reflected XSS | https://████████ to U.S. Dept Of Defense - 5 upvotes, $0
605. XSS via Client Side Template Injection on www.███/News/Speeches to U.S. Dept Of Defense - 5 upvotes, $0
607. Reflected XSS in ██████████ to U.S. Dept Of Defense - 5 upvotes, $0
608. XSS in twitter.com/safety/unsafe_link_warning to X (Formerly Twitter) - 4 upvotes, $1400
609. Stored XSS in the Shopify Discussion Forums to Shopify - 4 upvotes, $500
610. Strored Cross Site Scripting to Shopify - 4 upvotes, $500
611. a stored xss in slack integration https://onerror.slack.com/services/import to Slack - 4 upvotes, $500
612. XSS in my.shopify.com in widget to Shopify - 4 upvotes, $500
613. Reflected Cross-Site Scripting on French subdomain to Pornhub - 4 upvotes, $250
614. Cross Site Scripting - On Mouse Over, Blog page to Pornhub - 4 upvotes, $250
615. Reflected XSS Vulnerability in www.lahitapiola.fi/cs/Satellite to LocalTapiola - 4 upvotes, $250
616. [0.vk.com] Reflected XSS на странице подтверждения. to VK.com - 4 upvotes, $200
617. [reflected xss, pornhub.com] /blog, any to Pornhub - 4 upvotes, $100
618. XSS on 3rd party service Localtapiola is using to LocalTapiola - 4 upvotes, $100
619. Vulnerability found, XSS (Cross site Scripting) to Yahoo! - 4 upvotes, $0
620. Persistent class XSS [the fuck] to Khan Academy - 4 upvotes, $0
621. XSS IN member List (Because of City Textbox) to Concrete CMS - 4 upvotes, $0
622. XSS in main page (invitation) to Localize - 4 upvotes, $0
623. XSS Vulnerability (my.yahoo.com) to Yahoo! - 4 upvotes, $0
624. https://caldav.calendar.yahoo.com/ - XSS (STORED) to Yahoo! - 4 upvotes, $0
625. XSS in https://e.mail.ru/cgi-bin/lstatic (Limited use) to Mail.ru - 4 upvotes, $0
626. XSS in original referrer after follow to X (Formerly Twitter) - 4 upvotes, $0
627. Stored XSS in Slack.com to Slack - 4 upvotes, $0
628. Stored XSS in api key of operator wallet to Enter - 4 upvotes, $0
629. Stored Cross Site Scripting Vulnerability in Yahoo Mail to Yahoo! - 4 upvotes, $0
630. Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. to HackerOne - 4 upvotes, $0
631. apps.owncloud.com: XSS via referrer to ownCloud - 4 upvotes, $0
632. Persistent XSS in image title to Imgur - 4 upvotes, $0
633. Reflected XSS via. search to Adobe - 4 upvotes, $0
634. xss in DM group name in twitter to X (Formerly Twitter) - 4 upvotes, $0
635. Dom Based Xss to Uber - 4 upvotes, $0
636. [tz.mail.ru] XSS в функционале авторизации to Mail.ru - 4 upvotes, $0
637. Stored XSS on [your_zendesk].zendesk.com in Facebook Channel to Zendesk - 4 upvotes, $0
638. Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay to Zomato - 4 upvotes, $0
639. Reflected XSS at yaman.olx.ph to OLX - 4 upvotes, $0
640. Template stored XSS to drchrono - 4 upvotes, $0
641. XSS in uber oauth to Uber - 4 upvotes, $0
642. XSS via password recovering to Uber - 4 upvotes, $0
643. XSS in people.uber.com to Uber - 4 upvotes, $0
644. XSS in Tagregator plugin to Ian Dunn - 4 upvotes, $0
645. Arbitrary SQL query execution and reflected XSS in the "SQL Query Form" to ExpressionEngine - 4 upvotes, $0
646. these are my old reports and still i have not receive any good replys, these all are Cross Site Scripting(XSS) issues: POC1:
https://www.youtube.com/w to OLX - 4 upvotes, $0
647. stored SELF xss on Basic Google Maps Placemarks Settings plugin to Ian Dunn - 4 upvotes, $0
648. [support.my.com] Internet Explorer XSS to Mail.ru - 4 upvotes, $0
649. [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS to Nextcloud - 4 upvotes, $0
650. Reflected XSS in OLX.in to OLX - 4 upvotes, $0
651. REFLECTED CROSS SITE SCRIPTING IN OLX to OLX - 4 upvotes, $0
652. Stored XSS on new Calling plugin (spreed) to Nextcloud - 4 upvotes, $0
653. Persistent XSS vulnerability on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
654. Cross-site scripting vulnerability on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
656. Stored cross-site scripting (XSS) on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
657. Stored xss to ownCloud - 4 upvotes, $0
658. [marketplace.informatica.com] Profile stored XSS to Informatica - 4 upvotes, $0
659. XSS on username when register to proffesional account to FormAssembly - 4 upvotes, $0
661. Cross-Site Scripting (XSS) on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
662. Cross-site-Scripting to Paragon Initiative Enterprises - 4 upvotes, $0
663. [demo.weblate.org] Stored Self-XSS via Editor Link in Profile to Weblate - 4 upvotes, $0
664. Stored XSS in RSS Feeds Title (Concrete5 v8.1.0) to Concrete CMS - 4 upvotes, $0
667. Flash XSS on Buick_RotatingMasthead_JellyBeanSlider.swf to General Motors - 4 upvotes, $0
668. Stored XSS templates -> 'call for action' feature to Mixmax - 4 upvotes, $0
670. MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS) to Zomato - 4 upvotes, $0
671. XSS in flashmediaelement.swf (business-blog.zomato.com) to Zomato - 4 upvotes, $0
673. Reflective XSS vulnerability on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
674. Stored cross site scripting (XSS) vulnerability on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
675. xss found in zomato to Zomato - 4 upvotes, $0
676. Reflected XSS on hi-tech.mail.ru to Mail.ru - 4 upvotes, $0
677. Reflected XSS. to Mail.ru - 4 upvotes, $0
679. Cross-site scripting (XSS) on a DoD website to U.S. Dept Of Defense - 4 upvotes, $0
680. XSS Vulnerability in WooCommerce Product Vendors plugin to Automattic - 4 upvotes, $0
681. Reflective XSS to ExpressionEngine - 4 upvotes, $0
682. Cross site scripting in a subdomain of newrelic.com to New Relic - 4 upvotes, $0
683. Stored XSS on BillingCountry parameter to New Relic - 4 upvotes, $0
684. Non Critical Code Quality Bug / Self XSS on Map Editor to Infogram - 4 upvotes, $0
685. [redis-commander] Reflected SWF XSS via vulnerable "clipboard.swf" component to Node.js third-party modules - 4 upvotes, $0
686. Self-xss via drag&drop in email form to Mail.ru - 4 upvotes, $0
687. [afisha.mail.ru] HTML-инъекция через XSS на портале виджета to Mail.ru - 4 upvotes, $0
688. [crud-file-server] Stored XSS in filenames when directory index is served by crud-file-server to Node.js third-party modules - 4 upvotes, $0
689. [gem server] Stored XSS via crafted JavaScript URL inclusion in Gemspec to RubyGems - 4 upvotes, $0
690. [glance] Stored XSS via file name allows to run arbitrary JavaScript when directory listing is displayed in browser to Node.js third-party modules
- 4 upvotes, $0
691. Airship: Persistent XSS via Comment to Paragon Initiative Enterprises - 4 upvotes, $0
692. [exceljs] Possible XSS via cell value when worksheet is displayed in browser to Node.js third-party modules - 4 upvotes, $0
693. Browser Self XSS Protection not implemented to PortSwigger Web Security - 4 upvotes, $0
694. [serve] XSS via HTML tag injection in directory lisiting page to Node.js third-party modules - 4 upvotes, $0
695. [serve] Stored XSS in the filename when directories listing to Node.js third-party modules - 4 upvotes, $0
696. [target.my.com] CRLF Injection -> XSS to Mail.ru - 4 upvotes, $0
697. [beta.tracker.my.com] XSS Request-URI to Mail.ru - 4 upvotes, $0
698. XSS in Bootbox to Node.js third-party modules - 4 upvotes, $0
700. xss to Mail.ru - 4 upvotes, $0
701. Reflected Cross Site Scripting vuln in tomtom.com to TomTom - 4 upvotes, $0
702. self XSS на странице https://aw.mail.ru/pin/ to Mail.ru - 4 upvotes, $0
703. Stored XSS in embedded posts containing images to Vanilla - 4 upvotes, $0
704. [████████] Reflected XSS to U.S. Dept Of Defense - 4 upvotes, $0
705. [███████] Reflected GET XSS (/mission.php?...&missionDate=*) to U.S. Dept Of Defense - 4 upvotes, $0
706. Stored XSS on scan.nextcloud.com to Nextcloud - 4 upvotes, $0
707. potential RCE and XSS via file upload requiring user account and default settings to Nextcloud - 4 upvotes, $0
708. Unrestricted file upload leads to stored xss on https://████████/ to U.S. Dept Of Defense - 4 upvotes, $0
709. XSS (Cross site scripting) on https://apimgr.8x8.com to 8x8 - 4 upvotes, $0
710. Stored XSS agent_status to 8x8 - 4 upvotes, $0
711. HTML Injection leads to XSS on███ to U.S. Dept Of Defense - 4 upvotes, $0
712. Stored XSS firing if the error occurs when trying to delete the APM app to New Relic - 4 upvotes, $0
713. CSTI fix (#587829) bypass leading to stored XSS at plugins again to New Relic - 4 upvotes, $0
714. Cross Site Scripting and Open Redirect in affiliate-preview.php file to Revive Adserver - 4 upvotes, $0
715. Stored XSS through name / last name on https://██████████/ to U.S. Dept Of Defense - 4 upvotes, $0
716. Self XSS + CSRF Leads to Reflected XSS in https://████/ to U.S. Dept Of Defense - 4 upvotes, $0
717. Cross-site Scripting (XSS) - Reflected to Zivver - 4 upvotes, $0
718. XSS by MathML at Active Storage to Ruby on Rails - 4 upvotes, $0
719. Cross-Site Scripting thorough XSSJacking/PasteJacking Technique to Zivver - 4 upvotes, $0
720. Post-Auth Stored XSS with User Interaction leads to Remote Code Execution to Rocket.Chat - 4 upvotes, $0
721. xss on https://███████(█████████ parameter) to U.S. Dept Of Defense - 4 upvotes, $0
722. XSS due to CVE-2020-3580 [██████] to U.S. Dept Of Defense - 4 upvotes, $0
723. Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text" to Concrete CMS - 4 upvotes, $0
724. Stored XSS вирус в al_video.php?act=a_choose_video_box to VK.com - 4 upvotes, $0
725. Reflected XSS at https://█████████ via "███" parameter to U.S. Dept Of Defense - 4 upvotes, $0
726. XSS Stored on https://seedr.ru to Mail.ru - 4 upvotes, $0
727. XSS at videostore.mtnonline.com/GL/*.aspx via all parameters to MTN Group - 4 upvotes, $0
728. Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm to Acronis - 4 upvotes,
$0
729. stored cross site scripting in https://███████ to U.S. Dept Of Defense - 4 upvotes, $0
730. stored cross site scripting in https://██████████ to U.S. Dept Of Defense - 4 upvotes, $0
731. stored cross site scripting in https://█████████ to U.S. Dept Of Defense - 4 upvotes, $0
733. Reflected XSS in ██████████ to U.S. Dept Of Defense - 4 upvotes, $0
734. Cross-Site-Scripting in "Search Messages" to Rocket.Chat - 4 upvotes, $0
735. XSS in ServiceNow logout https://████:443 to U.S. Dept Of Defense - 4 upvotes, $0
736. XSS exploit of RDoc documentation generated by rdoc to Ruby - 4 upvotes, $0
737. Stored XSS in RDoc hyperlinks through javascript scheme to Ruby - 4 upvotes, $0
738. XSS in getrush.uber.com to Uber - 3 upvotes, $3000
739. XSS in L.mapbox.shareControl in mapbox.js to Mapbox - 3 upvotes, $1000
740. JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements) to GitHub Security Lab - 3 upvotes, $1000
741. Persistent Cross Site Scripting within the IRCCloud Pastebin to IRCCloud - 3 upvotes, $500
742. XSS on partners.uber.com to Uber - 3 upvotes, $500
743. [e.mail.ru] XSS на странице отправки денежного перевода to Mail.ru - 3 upvotes, $500
744. XSS by file (Active Storage Proxying ) to Ruby on Rails - 3 upvotes, $500
745. Reflected XSS and Open Redirect (verkkopalvelu.lahitapiola.fi) to LocalTapiola - 3 upvotes, $400
746. XSS Reflected incategories*p to Pornhub - 3 upvotes, $250
747. XSS ReflectedGET /embed_player? to Pornhub - 3 upvotes, $250
748. Reflective XSS can be triggered in IE to Slack - 3 upvotes, $150
749. Reflected Self-XSS Vulnerability in the Comment section of Files Information to Nextcloud - 3 upvotes, $100
750. csp bypass leads to xss on wacky.buggywebsite.com to BugPoC - 3 upvotes, $100
751. Solution for XSS challenge wacky.buggywebsite.com to BugPoC - 3 upvotes, $100
752. Cross site scripting to Deriv.com - 3 upvotes, $75
753. Dom based XSS https://www.khanacademy.org/ to Khan Academy - 3 upvotes, $0
754. http://smarthistory.khanacademy.org/search-results.html XSS to Khan Academy - 3 upvotes, $0
755. Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudents to Khan Academy - 3 upvotes, $0
756. XSS via Email to Respondly - 3 upvotes, $0
757. XSS via Email Link to Respondly - 3 upvotes, $0
758. XSS in password to Localize - 3 upvotes, $0
759. /index.php/dashboard/sitemap/explore/ Cross-site scripting to Concrete CMS - 3 upvotes, $0
760. XSS in Yahoo! Web Analytics to Yahoo! - 3 upvotes, $0
761. Yahoo! Reflected XSS to Yahoo! - 3 upvotes, $0
762. Flash XSS in http://go.mail.ru to Mail.ru - 3 upvotes, $0
763. XSS in editor by any user to Phabricator - 3 upvotes, $0
764. XSS ON MOPUB.COM to X (Formerly Twitter) - 3 upvotes, $0
765. Flash XSS in http://lingvo.mail.ru to Mail.ru - 3 upvotes, $0
766. stored xss in transaction to Enter - 3 upvotes, $0
767. Vulnerability type xss uncovered in airbnb.es to Airbnb - 3 upvotes, $0
768. Xss in website's link to Shopify - 3 upvotes, $0
769. XSS - URL Redirects to Shopify - 3 upvotes, $0
770. XSS in experts.shopify.com to Shopify - 3 upvotes, $0
771. XSS at importing Product List to Shopify - 3 upvotes, $0
772. XSS at Bulk editing products to Shopify - 3 upvotes, $0
773. [persistent cross-site scripting] customers can target admins to Shopify - 3 upvotes, $0
774. XSS using yql and developers console proxy to Yahoo! - 3 upvotes, $0
775. XSS in my yahoo to Yahoo! - 3 upvotes, $0
776. XSS Reflected - Yahoo Travel to Yahoo! - 3 upvotes, $0
777. [ishop.qiwi.com] XSS + Misconfiguration to QIWI - 3 upvotes, $0
778. Reflected XSS in chat. to Shopify - 3 upvotes, $0
779. Reflective Xss Vulnerability to Urban Dictionary - 3 upvotes, $0
780. XSS in WordPress to Automattic - 3 upvotes, $0
781. [start.icq.com] Reflected XSS via Cookies to Mail.ru - 3 upvotes, $0
782. xss to Keybase - 3 upvotes, $0
783. Stored XSS in Slack (weird, trial and error) to Slack - 3 upvotes, $0
784. Stored XSS in comments to Zendesk - 3 upvotes, $0
785. Stored XSS on vimeo.com and player.vimeo.com to Vimeo - 3 upvotes, $0
786. Sql injection And XSS to Khan Academy - 3 upvotes, $0
787. Stored XSS in comments to Zendesk - 3 upvotes, $0
788. XSS m.imgur.com to Imgur - 3 upvotes, $0
789. XSS vulnerability in "/coach/roster/" ( create your first class) to Khan Academy - 3 upvotes, $0
790. Cross site scripting On api Calculator API requests to ok.ru - 3 upvotes, $0
791. XSS at www.woothemes.com to Automattic - 3 upvotes, $0
792. Reflected XSS in owncloud.com to ownCloud - 3 upvotes, $0
793. Cross site scripting in apps.owncloud.com to ownCloud - 3 upvotes, $0
794. Vulnerability : XSS Vulnerability to Xero - 3 upvotes, $0
795. doc.owncloud.org: XSS via Referrer to ownCloud - 3 upvotes, $0
796. Stored Cross-Site Scripting in Map Share Page to Mapbox - 3 upvotes, $0
797. Possible XSS to HackerOne - 3 upvotes, $0
798. www.veris.in DOM based XSS to Veris - 3 upvotes, $0
799. stored XSS in concrete5 5.7.2.1 to Concrete CMS - 3 upvotes, $0
800. XSS on www.wordpress.com to Automattic - 3 upvotes, $0
801. XSS on gmchat.gm.com to General Motors - 3 upvotes, $0
802. Self-XSS Vulnerability on Password Reset Form to Uber - 3 upvotes, $0
803. XSS on codex.wordpress.org to Automattic - 3 upvotes, $0
804. Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 to Concrete CMS - 3 upvotes, $0
805. XSS on zomato.com to Zomato - 3 upvotes, $0
806. [github.algolia.com] XSS to Algolia - 3 upvotes, $0
807. Stored XSS from Display Settings triggered on Save and viewing realtime search demo to Algolia - 3 upvotes, $0
808. XSS in Subtitles of Vimeo Flash Player and Hubnut to Vimeo - 3 upvotes, $0
809. Reflected xss on websummit.net to WebSummit - 3 upvotes, $0
810. Reflected Cross site scripting to Veris - 3 upvotes, $0
811. Stored XSS на street-combats.mail.ru to Mail.ru - 3 upvotes, $0
812. Critical : Malware and XSS file can be uploaded and executed on udemy to Udemy - 3 upvotes, $0
813. Web Browser XSS Protection Not Enabled to Open-Xchange - 3 upvotes, $0
814. xss for admin of https://newsletter.nextcloud.com to Nextcloud - 3 upvotes, $0
815. Reflective XSS at dubai.dubizzle.com to OLX - 3 upvotes, $0
816. [api.login.icq.net] Reflected XSS to Mail.ru - 3 upvotes, $0
817. Reflected XSS on iltakoulu_varkaus (viestinta.lahitapiola.fi) to LocalTapiola - 3 upvotes, $0
818. XSS vulnerability on a DoD website to U.S. Dept Of Defense - 3 upvotes, $0
819. XSS in a newrelic.com site to New Relic - 3 upvotes, $0
820. stored xss issue in folder name on go.xero.com/Docs/Folders to Xero - 3 upvotes, $0
821. cross-site scripting in get request to OLX - 3 upvotes, $0
822. Self XSS at translation page through Editor Link at demo.weblate.org to Weblate - 3 upvotes, $0
825. DOM Based XSS on a DoD website to U.S. Dept Of Defense - 3 upvotes, $0
827. Reflected XSS. to Mail.ru - 3 upvotes, $0
830. SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint to Uber - 3 upvotes, $0
831. SSL-protected Reflected XSS in m.uber.com to Uber - 3 upvotes, $0
832. SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint to Uber - 3 upvotes, $0
833. udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint to Uber - 3
upvotes, $0
834. lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint to Uber - 3
upvotes, $0
835. Stored XSS in WordPress to WordPress - 3 upvotes, $0
836. [aw.my.com] Reflected XSS to Mail.ru - 3 upvotes, $0
837. [sexstatic] HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name
to Node.js third-party modules - 3 upvotes, $0
838. XSS in express-useragent through HTTP User-Agent to Node.js third-party modules - 3 upvotes, $0
839. Reflected Cross-Site Scripting in Serendipity (serendipity.SetCookie) to Hanno's projects - 3 upvotes, $0
840. Reflected XSS to GoCD - 3 upvotes, $0
841. Stored XSS на странице pubg.mail.ru/community to Mail.ru - 3 upvotes, $0
842. Reflected DOM-Based XSS On Due Lack Filter On Parameter ?next to Vercel - 3 upvotes, $0
843. Reflected XSS on www.tomtom.com to TomTom - 3 upvotes, $0
844. [min-http-server] Stored XSS in the filename when directories listing to Node.js third-party modules - 3 upvotes, $0
845. Reflected XSS on https://merchant.kartpay.com/payment_settings [status] to Kartpay - 3 upvotes, $0
846. █████ - DOM-based XSS to U.S. Dept Of Defense - 3 upvotes, $0
847. █████ - DOM-based XSS to U.S. Dept Of Defense - 3 upvotes, $0
848. [██████] Reflected GET XSS (/personnel.php?..&folder=*) with mouse action to U.S. Dept Of Defense - 3 upvotes, $0
849. Persistent XSS on favorite via filename to Nextcloud - 3 upvotes, $0
850. Reflected XSS on card.starbucks.com.sg/unsubRevert.php via the 'ct' Parameter to Starbucks - 3 upvotes, $0
851. [node-red] Stored XSS within Flow's - "Name" field to Node.js third-party modules - 3 upvotes, $0
852. Stored XSS in template comments. to Stripo Inc - 3 upvotes, $0
853. Post Based Reflected XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action to Topcoder - 3 upvotes, $0
854. Reflected XSS on error page on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action to Topcoder - 3 upvotes, $0
855. Reflected XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action to Topcoder - 3 upvotes, $0
856. [████████] — XSS on /███████_flight/images via advanced_val parameter to U.S. Dept Of Defense - 3 upvotes, $0
857. XSS Reflected to U.S. Dept Of Defense - 3 upvotes, $0
858. XSS on https://deti.mail.ru/ to Mail.ru - 3 upvotes, $0
859. Reflected XSS on http://axa.dxi.eu to 8x8 - 3 upvotes, $0
860. [service.engelvoelkers.com] XSS in /video/id to Engel & Völkers Technology GmbH - 3 upvotes, $0
861. Stored XSS in app.lemlist.com to lemlist - 3 upvotes, $0
862. Reflected XSS on ███████ page to U.S. Dept Of Defense - 3 upvotes, $0
863. Stored XSS at APM apps labels autocomplete dropdown (apps listing) to New Relic - 3 upvotes, $0
864. Stored admin-to-owner XSS at infrastructure alerts runbook URL leading to account takeover by malicious admin to New Relic - 3 upvotes, $0
865. [snekserve] Stored XSS via filenames HTML formatted to Node.js third-party modules - 3 upvotes, $0
866. Reflected XSS in https://███████ via search parameter to U.S. Dept Of Defense - 3 upvotes, $0
867. Reflected XSS at wacky.buggywebsite.com/frame.html to BugPoC - 3 upvotes, $0
868. reflected xss in ██████ to Engel & Völkers Technology GmbH - 3 upvotes, $0
869. Reflected XSS at ████ via ██████████= parameter to U.S. Dept Of Defense - 3 upvotes, $0
870. Stored XSS в m.vk.com/video to VK.com - 3 upvotes, $0
871. Reflected XSS at https://██████/██████████ via "████████" parameter to U.S. Dept Of Defense - 3 upvotes, $0
872. Reflected XSS at https://██████/██████ via "██████" parameter to U.S. Dept Of Defense - 3 upvotes, $0
873. XSS Reflected - ███ to U.S. Dept Of Defense - 3 upvotes, $0
874. XSS on https://██████/███ via █████ parameter to U.S. Dept Of Defense - 3 upvotes, $0
875. Reflected XSS [██████] to U.S. Dept Of Defense - 3 upvotes, $0
876. Reflected Xss in [██████] to U.S. Dept Of Defense - 3 upvotes, $0
877. Reflected XSS [██████] to U.S. Dept Of Defense - 3 upvotes, $0
878. XSS in Desktop Client via user status and information to Nextcloud - 3 upvotes, $0
879. XSS in Desktop Client in call notification popup to Nextcloud - 3 upvotes, $0
880. stored cross site scripting in https://████ to U.S. Dept Of Defense - 3 upvotes, $0
882. Reflected Cross-Site Scripting(CVE-2022-32770 ) to Rocket.Chat - 3 upvotes, $0
883. DOM Cross-Site Scripting ( XSS ) to X (Formerly Twitter) - 2 upvotes, $1400
884. XSS platform.twitter.com to X (Formerly Twitter) - 2 upvotes, $1120
885. Reflected Xss to Slack - 2 upvotes, $500
886. touch.mail.ru XSS via message id to Mail.ru - 2 upvotes, $500
887. XSS https://www.shopify.com/signup to Shopify - 2 upvotes, $500
888. www.shopify.com XSS on blog pages via sharing buttons to Shopify - 2 upvotes, $500
889. Stored XSS in https://checkout.shopify.com/ to Shopify - 2 upvotes, $500
890. XSS on https://app.shopify.com/ to Shopify - 2 upvotes, $500
891. Home page reflected XSS to Mail.ru - 2 upvotes, $250
892. an xss issue to Algolia - 2 upvotes, $100
893. Unauthenticated Stored XSS in API Panel to WePay - 2 upvotes, $100
894. Cross Site Scripting to Deriv.com - 2 upvotes, $50
895. Stored XSS in all fields in Basic Google Maps Placemarks Settings to Ian Dunn - 2 upvotes, $25
896. XSS in www.eobot.com(IE9 only) to Eobot - 2 upvotes, $10
897. Stored XSS to Slack - 2 upvotes, $0
898. https://www.khanacademy.org/coach/reports/activity XSS to Khan Academy - 2 upvotes, $0
899. XSS in Localize.io to Localize - 2 upvotes, $0
900. Xss in CampTix Event Ticketing to Ian Dunn - 2 upvotes, $0
901. Dangerous Persistent xss to IRCCloud - 2 upvotes, $0
902. Stored XSS in Channel Chat to Slack - 2 upvotes, $0
903. Persistent XSS in afisha.mail.ru to Mail.ru - 2 upvotes, $0
904. Reflected XSS in Pastebin-view to IRCCloud - 2 upvotes, $0
905. Flash XSS - http://hi-tech.mail.ru/ to Mail.ru - 2 upvotes, $0
906. XSS in "About Video" to Mail.ru - 2 upvotes, $0
907. XSS in Team Only Area to Localize - 2 upvotes, $0
908. https://polldaddy.com storage.swf XSS to Automattic - 2 upvotes, $0
909. xss in app.simplenote.com to Automattic - 2 upvotes, $0
910. XSS in the input to Respondly - 2 upvotes, $0
911. XSS in Stopthehacker support to StopTheHacker - 2 upvotes, $0
912. Flash XSS on swfupload.swf showing at app.mavenlink.com to Mavenlink - 2 upvotes, $0
914. Unchecking hidden parameter is vulnerable to XSS-attack to Khan Academy - 2 upvotes, $0
915. rs.mail.ru - Flash Based XSS to Mail.ru - 2 upvotes, $0
916. Cross Site Scripting (XSS) - app.relateiq.com to RelateIQ - 2 upvotes, $0
917. Stored XSS in username.slack.com to Slack - 2 upvotes, $0
918. http://cdnjs.cloudflare.com/ Cross-site scripting 2 to Cloudflare Vulnerability Disclosure - 2 upvotes, $0
919. XSS in https://hk.user.auctions.yahoo.com to Yahoo! - 2 upvotes, $0
920. XSS on Every sports.yahoo.com page to Yahoo! - 2 upvotes, $0
921. Reflected cross site scripting in login page to StopTheHacker - 2 upvotes, $0
922. Suffix of url-path is vulnerable to XSS-attack to Khan Academy - 2 upvotes, $0
923. Stored xss to X (Formerly Twitter) - 2 upvotes, $0
924. Browser cross-site scripting filter misconfiguration to ReddAPI - 2 upvotes, $0
925. ads.twitter.com xss to X (Formerly Twitter) - 2 upvotes, $0
926. Stored XSS on http://cards.mail.ru to Mail.ru - 2 upvotes, $0
927. [qiwi.com] /oauth/confirm.action XSS to QIWI - 2 upvotes, $0
928. XSS in fabric.io to X (Formerly Twitter) - 2 upvotes, $0
929. [static.qiwi.com] XSS proxy.html to QIWI - 2 upvotes, $0
930. Stored XSS on http://top.mail.ru to Mail.ru - 2 upvotes, $0
931. Vimeo Search - XSS Vulnerability [http://vimeo.com/search] to Vimeo - 2 upvotes, $0
932. XSS on Vimeo to Vimeo - 2 upvotes, $0
933. Stored XSS in Direct debit name to Mobile Vikings - 2 upvotes, $0
934. Stored xss in user name to Mobile Vikings - 2 upvotes, $0
935. Reflected xss in user name thru cookie to Mobile Vikings - 2 upvotes, $0
936. Stored xss in user name (2) affected another user. to Mobile Vikings - 2 upvotes, $0
937. Reflected Cross Site Scripting - 'puser' Parameter in login page to Adobe - 2 upvotes, $0
938. Open redirect and reflected xss in http://youthvoices.adobe.com/community?return_url=[payload her] to Adobe - 2 upvotes, $0
939. XSS in myshopify.com Admin site in TAX Overrides to Shopify - 2 upvotes, $0
940. XSS on support.shopify.com to Shopify - 2 upvotes, $0
941. XSS at Bulk editing ProductVariants to Shopify - 2 upvotes, $0
942. xss profile to Udemy - 2 upvotes, $0
943. XSS in Myshopify Admin Site in DISCOUNTS to Shopify - 2 upvotes, $0
944. Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS to Shopify - 2 upvotes, $0
945. Reflected XSS in chat to Shopify - 2 upvotes, $0
946. Reflected XSS in mail.yahoo.com to Yahoo! - 2 upvotes, $0
947. XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com) to Shopify - 2 upvotes, $0
948. No CSRF protection when creating new community points actions, and related stored XSS to Concrete CMS - 2 upvotes, $0
949. Stored Cross site scripting In developer.zendesk.com to Zendesk - 2 upvotes, $0
950. XSS on ecommerce.shopify.com to Shopify - 2 upvotes, $0
951. files.mail.ru: XSS to Mail.ru - 2 upvotes, $0
952. /surveys/2auth: DOM-based XSS to Mail.ru - 2 upvotes, $0
953. help2.m.smailru.net: XSS to Mail.ru - 2 upvotes, $0
954. XSS on https://www.udemy.com/asset/export.html to Udemy - 2 upvotes, $0
955. apps.owncloud.com: Stored XSS in profile page to ownCloud - 2 upvotes, $0
956. Cross-site Scripting in all Zopim to Zendesk - 2 upvotes, $0
957. XSS at http://vk.com on IE using flash files to VK.com - 2 upvotes, $0
958. apps.owncloud.com: Potential XSS to ownCloud - 2 upvotes, $0
959. XSS Vulnerability to Udemy - 2 upvotes, $0
960. XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо to
Mail.ru - 2 upvotes, $0
961. Cookie securing your "Opening soon" store is not secured against XSS to Shopify - 2 upvotes, $0
962. XSS in creating tweets to Shopify - 2 upvotes, $0
963. Cross-site Scripting https://www.zendesk.com/product/pricing/ to Zendesk - 2 upvotes, $0
964. Reflective Xss on news.mail.ru and admin.news.mail.ru to Mail.ru - 2 upvotes, $0
965. Flash XSS на old.corp.mail.ru to Mail.ru - 2 upvotes, $0
966. XSS in imgur mobile to Imgur - 2 upvotes, $0
967. XSS in imgur mobile 3 to Imgur - 2 upvotes, $0
968. XSS at forum : to Mail.ru - 2 upvotes, $0
969. Stored XSS on https://www.algolia.com/realtime-search-demo/* to Algolia - 2 upvotes, $0
970. Self-XSS in mails sent by [email protected] to ownCloud - 2 upvotes, $0
971. Stored XSS in /admin/orders to Shopify - 2 upvotes, $0
972. Stored XSS in adding fileset to Concrete CMS - 2 upvotes, $0
973. Cross-Site Scripting Vulnerability in urbandictionary.com to Urban Dictionary - 2 upvotes, $0
974. Cross-Site Scripting Vulnerability in dovecot.fi to Open-Xchange - 2 upvotes, $0
975. Stored Cross-Site Scripting via Angular Template Injection to New Relic - 2 upvotes, $0
976. Reflected XSS на games.mail.ru to Mail.ru - 2 upvotes, $0
977. Stored XSS in member book to Veris - 2 upvotes, $0
978. XSS in Asset name to Veris - 2 upvotes, $0
979. [login.newrelic.com] XSS via return_to to New Relic - 2 upvotes, $0
980. xss yaman.olx.ph to OLX - 2 upvotes, $0
981. XSS, Unvalidated redirects & phishing website hosting on dropbox servers to Dropbox - 2 upvotes, $0
982. XSS in GM to General Motors - 2 upvotes, $0
983. [forum.owncloud.org] IE, Edge XSS via Request-URI to ownCloud - 2 upvotes, $0
984. Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads) to Nextcloud - 2 upvotes, $0
985. XSS Via Method injection to Gratipay - 2 upvotes, $0
986. XSS and Open Redirect on https://jobs.dubizzle.com/ to OLX - 2 upvotes, $0
987. XSS and HTML Injection https://sharjah.dubizzle.com/ to OLX - 2 upvotes, $0
988. Reflected XSS in www.lahitapiola.fi (/cs/Satellite) using Oracle WebCenter -page to LocalTapiola - 2 upvotes, $0
989. Reflected XSS vulnerability in a DoD website to U.S. Dept Of Defense - 2 upvotes, $0
990. hosted.weblate.org: X-XSS-Protection not enabled to Weblate - 2 upvotes, $0
991. weblate.org: X-XSS-Protection not enabled to Weblate - 2 upvotes, $0
992. CSS to Zomato - 2 upvotes, $0
993. Stored XSS vulnerability on a DoD website to U.S. Dept Of Defense - 2 upvotes, $0
995. Stored XSS in Gallery application (NC-SA-2017-010) to Nextcloud - 2 upvotes, $0
996. IE search XSS to General Motors - 2 upvotes, $0
997. XSS Vulnerability in developer.gm.com to General Motors - 2 upvotes, $0
998. xss to Gratipay - 2 upvotes, $0
999. [cloudcmd] Stored XSS in the filename when directories listing to Node.js third-party modules - 2 upvotes, $0
000. [legal.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
001. [allods.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
002. [id.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
003. [furry.aw.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
004. [evo2.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
005. [evo.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
006. [mg.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
007. [support.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
008. [wos.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
009. [account.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
010. [lucky-fields.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
011. [sf.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
012. [games.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
013. XSS in "explore-keywords-dropdown" results. to Zomato - 2 upvotes, $0
014. Cross site scripting (content-sniffing) to Liberapay - 2 upvotes, $0
015. [buttle] HTML Injection in filename leads to XSS when directory listing is displayed in the browser to Node.js third-party modules - 2 upvotes, $0
016. XSS on New contact to Mail.ru - 2 upvotes, $0
017. Reflected Xss bypass Content-Type: text/plain to Python Cryptographic Authority - 2 upvotes, $0
018. xss to Mail.ru - 2 upvotes, $0
019. XSS On Nextcloud Integrated with zimbra drive to Nextcloud - 2 upvotes, $0
020. Stored XSS at branded site in .mail.ru domain to Mail.ru - 2 upvotes, $0
021. Strored Xss on https://my.stripo.email/ ( multiple inputs) to Stripo Inc - 2 upvotes, $0
022. Prevent XSS when passing a parameter directly into link_to to Ruby on Rails - 2 upvotes, $0
023. Reflected XSS on https://███████/ to U.S. Dept Of Defense - 2 upvotes, $0
024. [garnier-olia.lady.mail.ru] Reflected XSS /exp/ bypass "/" to Mail.ru - 2 upvotes, $0
025. Stored XSS in agoric-sdk - malicious iframes, malicious svg to Agoric - 2 upvotes, $0
026. Reflected XSS - https://███ to U.S. Dept Of Defense - 2 upvotes, $0
027. Reflected Cross-Site Scripting/HTML Injection to Informatica - 2 upvotes, $0
028. Reflected XSS in https://███████ via hidden parameter "████████" to U.S. Dept Of Defense - 2 upvotes, $0
029. Reflected XSS at https://██████████/████████ via "███████" parameter to U.S. Dept Of Defense - 2 upvotes, $0
030. XSS trigger via HTML Iframe injection in ( https://██████████ ) due to unfiltered HTML tags to U.S. Dept Of Defense - 2 upvotes, $0
031. CVE-2021-42567 - Apereo CAS Reflected XSS on https://█████████ to U.S. Dept Of Defense - 2 upvotes, $0
032. [www.█████] Path-based reflected Cross Site Scripting to U.S. Dept Of Defense - 2 upvotes, $0
033. Reflected XSS [███] to U.S. Dept Of Defense - 2 upvotes, $0
035. STORED XSS in █████████/nlc/login.aspx via "edit" GET parameter through markdown editor [HtUS] to U.S. Dept Of Defense - 2 upvotes, $0
036. Persistent CSS injection with ’marked’ markdown parser in Rocket.Chat to Rocket.Chat - 2 upvotes, $0
037. Reflected XSS | https://████ to U.S. Dept Of Defense - 2 upvotes, $0
038. XSS platform.twitter.com | video-js metadata to X (Formerly Twitter) - 1 upvotes, $1120
039. XSS In archive.uber.com Due to Mime Sniffing in IE to Uber - 1 upvotes, $750
040. XSS in dropbox main domain to Dropbox - 1 upvotes, $512
041. XSS in a file or folder name to Mail.ru - 1 upvotes, $500
042. e.mail.ru stored XSS in agent via sticker (smile) to Mail.ru - 1 upvotes, $500
043. auth.mail.ru: XSS in login form to Mail.ru - 1 upvotes, $500
044. www.shopify.com XSS via third-party script to Shopify - 1 upvotes, $500
045. many xss in widgets.shopifyapps.com to Shopify - 1 upvotes, $500
046. XSS on hardware.shopify.com to Shopify - 1 upvotes, $500
047. xss in the all widgets of shopifyapps.com to Shopify - 1 upvotes, $500
048. File upload XSS (Java applet) on http://slackatwork.com/ to Slack - 1 upvotes, $200
049. cloud.mail.ru: File upload XSS using Content-Type header to Mail.ru - 1 upvotes, $150
050. xss in /browse/contacts/ to Openfolio - 1 upvotes, $100
051. DOM Based XSS in Checkout to LeaseWeb - 1 upvotes, $100
052. an xss issue in https://hunter22.slack.com/help/requests/793043 to Slack - 1 upvotes, $100
053. www.lahitapiola.fi DOM XSS by choosing regional company to LocalTapiola - 1 upvotes, $100
054. Stored XSS to Localize - 1 upvotes, $0
055. Import emails from Gmail are activate XSS to Respondly - 1 upvotes, $0
056. Find, private notes Cross-site scripting. to Respondly - 1 upvotes, $0
057. Persistent Cross-site scripting vulnerability settings. to Respondly - 1 upvotes, $0
058. XSS - http://js.cloudflare.com to Cloudflare Vulnerability Disclosure - 1 upvotes, $0
059. Stored XSS in slack.com (integrations) to Slack - 1 upvotes, $0
060. XSS 01 on staging.fct.li to Factlink - 1 upvotes, $0
061. Xss On http://my.mail.ru/ to Mail.ru - 1 upvotes, $0
062. genericons.com - DOM based XSS. to Automattic - 1 upvotes, $0
063. http://jetpack.me/ Self XSS to Automattic - 1 upvotes, $0
064. email field doesn't filtered against XSS to Uzbey - 1 upvotes, $0
065. Cross-site scripting vulnerability detected to Uzbey - 1 upvotes, $0
066. Album image XSS to Uzbey - 1 upvotes, $0
067. XSS to jsDelivr - 1 upvotes, $0
068. XSS vulnerability in video player page to X (Formerly Twitter) - 1 upvotes, $0
069. Cross site scripting in type parameter to Uzbey - 1 upvotes, $0
070. jplayer.swf Cross-site scripting to Cloudflare Vulnerability Disclosure - 1 upvotes, $0
071. XSS Reflected - https://www.stopthehacker.com/ to StopTheHacker - 1 upvotes, $0
072. xss in simperium.com to Automattic - 1 upvotes, $0
073. Cross-Site Scripting in getMarketplacePurchaseFrame to Concrete CMS - 1 upvotes, $0
074. TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP‐DV‐001) to Yahoo! - 1 upvotes, $0
075. XSS in Theme Preview Tools File to Concrete CMS - 1 upvotes, $0
076. XSS on gravatar to Automattic - 1 upvotes, $0
078. Reflected XSS in User-Agent to Mail.ru - 1 upvotes, $0
079. Cross Site Scripting (Stored) to ExpressionEngine - 1 upvotes, $0
080. XSS in 3rd party plugin (not affecting Uzbey's users) to Uzbey - 1 upvotes, $0
081. [send.qiwi.ru] XSS at auth?login= to QIWI - 1 upvotes, $0
082. Cross-site Scripting in mailing (username) to RelateIQ - 1 upvotes, $0
083. APIs for channels allow HTML entities that may cause XSS issue to Vimeo - 1 upvotes, $0
084. Vimeo.com - reflected xss vulnerability to Vimeo - 1 upvotes, $0
085. player.vimeo.com - Reflected XSS Vulnerability to Vimeo - 1 upvotes, $0
086. Stored XSS in concrete5 5.7.0.4. to Concrete CMS - 1 upvotes, $0
087. XSS Vulnerability in cfire.mail.ru/screen/1/ to Mail.ru - 1 upvotes, $0
088. Vimeo.com - Reflected XSS Vulnerability to Vimeo - 1 upvotes, $0
089. files.acrobat.com stored XSS via send file to Adobe - 1 upvotes, $0
090. XSS with Time-of-Day Format to Phabricator - 1 upvotes, $0
091. XSS in realty.mail.ru to Mail.ru - 1 upvotes, $0
092. XSS in ad.mail.ru to Mail.ru - 1 upvotes, $0
093. XSS Vulnerability on all pages to Mobile Vikings - 1 upvotes, $0
094. Pretty Photo Dom XSS to jsDelivr - 1 upvotes, $0
095. XSS in touch.sports.mail.ru to Mail.ru - 1 upvotes, $0
096. Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 to Concrete CMS - 1 upvotes, $0
097. XSS in https://app.mavenlink.com/workspaces/ to Mavenlink - 1 upvotes, $0
098. XSS on added name album on videos. to VK.com - 1 upvotes, $0
099. Stored XSS on Title of Page List in edit page list to Concrete CMS - 1 upvotes, $0
100. Stored XSS on Search Title to Concrete CMS - 1 upvotes, $0
101. Stored XSS in Contact Form to Concrete CMS - 1 upvotes, $0
102. Stored XSS in Title of the topic List to Concrete CMS - 1 upvotes, $0
103. Stored XSS in title of date navigation to Concrete CMS - 1 upvotes, $0
104. Stored XSS in Feature tile to Concrete CMS - 1 upvotes, $0
105. Stored Xss in Feature Paragraph to Concrete CMS - 1 upvotes, $0
106. Stored XSS in Testimonial name to Concrete CMS - 1 upvotes, $0
107. Stored XSS in testimonial Company to Concrete CMS - 1 upvotes, $0
108. Stored XSS in Testimonial Position to Concrete CMS - 1 upvotes, $0
109. Stored XSS In Company URL to Concrete CMS - 1 upvotes, $0
110. Stored XSS in Image Alt. Text to Concrete CMS - 1 upvotes, $0
111. Stored XSS in Message to Display When No Pages Listed. to Concrete CMS - 1 upvotes, $0
112. Stored XSS in Bio/Quote to Concrete CMS - 1 upvotes, $0
113. Stored XSS on Blog's page Tile to Concrete CMS - 1 upvotes, $0
114. Self Xss on File Replace to Concrete CMS - 1 upvotes, $0
115. Cross site scripting to Enter - 1 upvotes, $0
116. Multiple XSS Vulnerabilities in Concrete5 5.7.3.1 to Concrete CMS - 1 upvotes, $0
117. xss on autoserch to Udemy - 1 upvotes, $0
118. XSS in Search Communities Function to Informatica - 1 upvotes, $0
119. XSS - Gallery Search Listing to Zaption - 1 upvotes, $0
120. api.video.mail.ru: XSS to Mail.ru - 1 upvotes, $0
121. touch.afisha.mail.ru: XSS to Mail.ru - 1 upvotes, $0
122. target.mail.ru: XSS через Referer to Mail.ru - 1 upvotes, $0
123. target.mail.ru: XSS to Mail.ru - 1 upvotes, $0
124. 3k.mail.ru: XSS to Mail.ru - 1 upvotes, $0
125. GET /surveys/2auth: XSS to Mail.ru - 1 upvotes, $0
126. owncloud.com: DOM Based XSS to ownCloud - 1 upvotes, $0
127. [riot.mail.ru] Reflected XSS in debug-mode to Mail.ru - 1 upvotes, $0
128. Flash XSS on img.mail.ru to Mail.ru - 1 upvotes, $0
129. Reflected Self-XSS in Slack to Slack - 1 upvotes, $0
130. Self-XSS in posts by formatting text as code to Slack - 1 upvotes, $0
131. Persistent XSS in https://p.imgur.com/albumview.gif and http://p.imgur.com/imageview.gif / post statistics to Imgur - 1 upvotes, $0
132. XSS Reflected in test.qiwi.ru to QIWI - 1 upvotes, $0
133. owncloud.com: Persistent XSS In Account Profile to ownCloud - 1 upvotes, $0
134. reflected in xss to Mail.ru - 1 upvotes, $0
135. XSS at wordpress.com to Automattic - 1 upvotes, $0
136. Self XSS Protection not used , I can trick users to insert JavaScript to Gratipay - 1 upvotes, $0
137. Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modification to Udemy - 1 upvotes, $0
138. Cross Site Scripting - type Patameter to Zomato - 1 upvotes, $0
139. Xss via Dropbox to ThisData - 1 upvotes, $0
140. apps.owncloud.com: Multiple reflected XSS by insecure URL generation (IE only) to ownCloud - 1 upvotes, $0
141. Cross Site Scripting to Mail.ru - 1 upvotes, $0
142. Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/ to Uber - 1 upvotes, $0
143. Stored XSS via "Free Shipping" option (Discounts) to Shopify - 1 upvotes, $0
144. doc.owncloud.org: X-XSS-Protection not enabled to ownCloud - 1 upvotes, $0
145. Synthetics Xss to New Relic - 1 upvotes, $0
146. Stored XSS in Access Rules to Veris - 1 upvotes, $0
147. STORED XSS FOUND to ThisData - 1 upvotes, $0
148. Cross-site Scripting (XSS) to Uber - 1 upvotes, $0
149. XSS on love.uber.com to Uber - 1 upvotes, $0
150. Stored XSS on 'Badges' page to Veris - 1 upvotes, $0
151. Stored XSS through Angular Expression Sandbox Escape to New Relic - 1 upvotes, $0
152. XSS to Deriv.com - 1 upvotes, $0
153. XSS and CSRF in Zomato Contact form to Zomato - 1 upvotes, $0
154. XSS In /zuora/ functionality to Zendesk - 1 upvotes, $0
155. DOM based XSS on to Uber - 1 upvotes, $0
156. Reflected XSS on Zomato API to Zomato - 1 upvotes, $0
157. Persistent XSS on Reservation / Booking Page to Zomato - 1 upvotes, $0
158. Reflected XSS in Backend search to Moneybird - 1 upvotes, $0
159. Multiple Stored XSS on Sanbox.veris.in through Veris Frontdesk Android App to Veris - 1 upvotes, $0
160. Multiple Stored XSS to Veris - 1 upvotes, $0
161. Stored XSS to Veris - 1 upvotes, $0
162. XSS in Blog to drchrono - 1 upvotes, $0
163. Reflected XSS in domain www.veris.in to Veris - 1 upvotes, $0
164. Self-XSS in Partners Profile to Uber - 1 upvotes, $0
165. Stored self-XSS at m.uber.com to Uber - 1 upvotes, $0
166. Self-XSS on partners.uber.com to Uber - 1 upvotes, $0
167. Two XSS vulns in widget parameters (all_collections.php and o2.php) to Zomato - 1 upvotes, $0
168. [Stored Cross-Site-Scripting] When search about Incoming ( Manual Jurnal ) to Moneybird - 1 upvotes, $0
169. DOM XSS bypassing in Regional Office -selector to LocalTapiola - 1 upvotes, $0
170. Google Authenticator - Cross Site Scripting to Ian Dunn - 1 upvotes, $0
171. Reflected XSS @ games.mail.ru to Mail.ru - 1 upvotes, $0
172. Stored Xss in rpm.newrelic.com to New Relic - 1 upvotes, $0
173. DOM based XSS in search functionality to SecNews - 1 upvotes, $0
174. xss on demo.nextcloud.com due to outdated version to Nextcloud - 1 upvotes, $0
175. Full Page Caching Stored XSS Vulnerability to Concrete CMS - 1 upvotes, $0
176. Cross Site Scripting to Nextcloud - 1 upvotes, $0
177. Reflected XSS on ht.pornhub.com - /export/GetPreview to Pornhub - 1 upvotes, $0
179. XSS found In Your Web to Gratipay - 1 upvotes, $0
180. XSS on app.legalrobot.com to Legal Robot - 1 upvotes, $0
181. Reflected XSS in admin settings to Deconf - 1 upvotes, $0
183. XSS in https://merchant.kartpay.com/settlements to Kartpay - 1 upvotes, $0
184. [dy-server2] - stored Cross-Site Scripting to Node.js third-party modules - 1 upvotes, $0
185. xss on setup config page to Nextcloud - 1 upvotes, $0
186. Reflected XSS on https://█████ to U.S. Dept Of Defense - 1 upvotes, $0
187. xss reflected on https://███████- (███ parameters) to U.S. Dept Of Defense - 1 upvotes, $0
188. XSS Reflected on https://███ (███ parameter) to U.S. Dept Of Defense - 1 upvotes, $0
189. XSS due to CVE-2020-3580 [███] to U.S. Dept Of Defense - 1 upvotes, $0
190. 3x Reflected XSS vectors for services.cgi (XM.v6.1.6, build 32290) to Ubiquiti Inc. - 1 upvotes, $0
191. 4 xss vulnerability dom based cwe 79 ; wordpress bootstrap.min.js is vulnerable to Sifchain - 1 upvotes, $0
192. Reflected XSS on https://███/████via hidden parameter "█████████" to U.S. Dept Of Defense - 1 upvotes, $0
193. XSS because of Akamai ARL misconfiguration on ████ to U.S. Dept Of Defense - 1 upvotes, $0
194. Reflected XSS - in Email Input to U.S. Dept Of Defense - 1 upvotes, $0
195. XSS on https://███████/██████████ parameter to U.S. Dept Of Defense - 1 upvotes, $0
196. XSS on https://████████/████' parameter to U.S. Dept Of Defense - 1 upvotes, $0
197. Reflected XSS via File Upload to Reddit - 1 upvotes, $0
198. XSS via .eml file to Mail.ru - 0 upvotes, $1337
199. XSS in https://hackpad.com/ to Dropbox Acquisitions - 0 upvotes, $216
200. Stored XSS through fileupload to Mail.ru - 0 upvotes, $200
201. Flash-based XSS in cdnjs.cloudflare.com subdomain to Cloudflare Vulnerability Disclosure - 0 upvotes, $0
202. Stored Cross-Site Scripting Vulnerability in /admin.php?/cp/admin_system/general_configuration to ExpressionEngine - 0 upvotes, $0
203. Unvalidated Redirects and Stored XSS to Dropbox - 0 upvotes, $0
204. XSS in version history of an HTML file in a shared folder to Dropbox - 0 upvotes, $0
205. otrs.owncloud.com: Reflected Cross-Site Scripting to ownCloud - 0 upvotes, $0
206. Stored XSS to Udemy - 0 upvotes, $0
207. XSS via modified Zomato widget (res_search_widget.php) to Zomato - 0 upvotes, $0
208. Reflected Cross Site scripting Attack (XSS) to OLX - 0 upvotes, $0
209. Improper parsing of input could lead to future XSS vulnerabilities in Sequences to Mixmax - 0 upvotes, $0
210. self cross site scripting to Gratipay - 0 upvotes, $0
211. x-xss protection header is not set in response header to Gratipay - 0 upvotes, $0
212. XSS (Reflected) to New Relic - 0 upvotes, $0
213. Self XSS via help.mail.ru interface to Mail.ru - 0 upvotes, $0
214. Stored XSS on ████████helpdesk to U.S. Dept Of Defense - 0 upvotes, $0
215. [flsaba] Stored XSS in the file and directory name when directories listing to Node.js third-party modules - 0 upvotes, $0
216. [tianma-static] Security issue with XSS. to Node.js third-party modules - 0 upvotes, $0
217. XSS DI BIODATA to Bumble - 0 upvotes, $0
218. XSS due to CVE-2020-3580 [███.mil] to U.S. Dept Of Defense - 0 upvotes, $0

2000+ Top XSS Reports From HackerOne

Uploaded by

Copyright:

Available Formats

2000+ Top XSS Reports From HackerOne

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2000+ Top XSS Reports From HackerOne

Uploaded by

Copyright:

Available Formats

Top XSS reports from HackerOne (2000+)

386. XSS on ███ to U.S. Dept Of Defense - 7 upvotes, $0

You might also like