Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/3556892 by zorixu
The DAST trial request form at https://portswigger.net/burp/dast/trial is vulnerable to HTML injection through the "First Name" field. User-supplied input is not properly sanitized before being inserted into confirmation emails, allowing attackers to inject arbitrary HTML content that gets rendered in the victim's email client. This vulnerability can be exploited to conduct sophisticated phishing attacks that appear to originate from PortSwigger's legitimate email infrastructure.
https://portswigger.net/burp/dast/trial
hamed_pesaheHow a simple payload and a shift in mindset exposed a vulnerability hidden in a complex invite and notification system.
heroxo9868HTML Injection is a web security vulnerability that occurs when an application fails to properly sanitize or validate user-supplied input before rendering it in a web page. As a result, an attacker can insert arbitrary HTML code into the page, which is then displayed and executed in the browsers of other users. This can allow the attacker to manipulate the structure or content of the page, inject misleading elements, or create malicious links, potentially compromising user trust and the integrity of the website.
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In