Cross-site Scripting (XSS) - DOM (CWE-79)CVSS 8.1Hard

DOM XSS to High Severity via Credential Phishing Overlay

April 19, 2026

82 views

€470

Vulnerability Summary

A DOM-based XSS vulnerability was discovered affecting multiple endpoints within a financial institution's web application. The target_route parameter was being processed client-side without proper validation or sanitization. This flaw allowed an attacker to execute arbitrary JavaScript code by utilizing the javascript: URI scheme.

Summary

A DOM-based XSS vulnerability was discovered affecting multiple endpoints within a financial institution's web application. The target_route parameter was being processed client-side without proper validation or sanitization. This flaw allowed an attacker to execute arbitrary JavaScript code by utilizing the javascript: URI scheme.

Affected Endpoints

The vulnerability was present on several application pages. Some examples include:

https://www.redacted-bank.com/retail/promotions-search?target_route=javascript:...
https://www.redacted-bank.com/retail/fraud-prevention?target_route=javascript:...
https://www.redacted-bank.com/corporate/agreements-search?target_route=javascript:...

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Sign In Register

Related Writeups

hackerone-reports

DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover

HackerOne disclosed report --> https://hackerone.com/reports/3608199 by xavlimsg

Read Writeup →

heroxo9868

XSS Bypass to Zero Click Account Takeover in AI Chatbot

Poor HTML sanitization combined with a file upload feature led to a stored XSS that allowed administrator accounts to be compromised.

LogicalBreach Academy