3 ms·
Usernames aren't sanitized yet. (As is visible with the '<asdf' in the 'foobar' link above.) EG: http://profile.io/xss2 http://profile.io/xss2
by Xk 16y ago
Usernames aren't sanitized yet. (As is visible with the '<asdf' in the 'foobar' link above.)
EG: http://profile.io/xss2 http://profile.io/xss2
- qeorge 16y agoAlso, you missed the login form (both in the header and on http://profile.io/login http://profile.io/login). Its echoing the username directly, e.g., "Username <script>alert(1)</script> was not found"