Cross-site Scripting (XSS) - DOM (CWE-79)CVSS 7.5 PRO

XSS Bypass to Zero Click Account Takeover in AI Chatbot

1 views

Vulnerability Summary

Poor HTML sanitization combined with a file upload feature led to a stored XSS that allowed administrator accounts to be compromised.

Application Overview

Let’s refer to the company as A.Corp.

Instead of integrating a third-party chatbot, A.Corp developed its own AI assistant from the ground up:

You must be logged in to read this writeup. Join our community of researchers today.