HackerOne
hackerone.com › reports › 1200770
Report #1200770 - XSS trigger via HTML Iframe injection ...
Hi team, I found an Iframe injection issue where I chained it and formed an XSS. I found the issue in the text editor area while ███████ing the account. There is a place in the registration area where we have to give a reason for █████████. We can write our reason and edit to show more beautifully.
HackerOne
hackerone.com › reports › 355458
Report #355458 - [statics-server] XSS via injected iframe in ...
May 21, 2018 - Hi Team, I would like to report HTML Injection in statics-server module. It is possible to inject malicious ```iframe``` tag via filename and execute arbitray JavaScript code. # Module **module name:** statics-server **version:** 0.0.9 **npm ...
HackerOne
hackerone.com › reports › 1514554
TikTok disclosed on HackerOne: XSS and iframe injection on tiktok...
A Cross-Site Scripting (XSS) vulnerability was found on a TikTok Ads endpoint via the "redirect" parameter. We thank @cancerz for reporting this to our team.
HackerOne
hackerone.com › reports › 331110
Node.js third-party modules disclosed on HackerOne: [buttle] HTML...
March 29, 2018 - I would like to report HTML Injection in buttle module. Due to lack of filenames sanitization, it is possible to inject malicious ```iframe``` tag via filename and execute arbitray JavaScript code. # Module **module name:** buttle **version:** 0.2.0 **npm page:** https://www.npmjs.com/package/buttle ## Module Description Simple static file (+ markdown) server.
HackerOne
hackerone.com › reports › 309394
Node.js third-party modules disclosed on HackerOne: [anywhere] An...
January 25, 2018 - Hi Guys, **anywhere** allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript. **Module:** Running static file server anywhere. https://www.npmjs.com/package/anywhere **Description** To embed ...
HackerOne
hackerone.com › reports › 1166766
Stripo Inc disclosed on HackerOne: Bypassing...
April 16, 2021 - CSP includes `*.firebaseapp.com` , instead of just `stripo-app.firebaseapp.com` therefore allowing any users to include their own iframe by hosting it on google firebase > *correction: There is no such thing as iframe xss, this should be iframe injection :))*
Medium
jmrcsnchz.medium.com › playing-with-iframes-bypassing-content-security-policy-987c2f0b8e8a
Playing With iframes: Bypassing Content-Security-Policy | by 0xEchidonut | Medium
July 30, 2021 - company.com -> parent window hackerone-jm.firebaseapp.com -> child (iframe) Well, iframes are naughty children, they can mess with their parents most of the time if not given proper counter-measures. I watch anime in pirated streaming sites, and one thing all of us will remember are those annoying pop-ups and redirects. This is what inspired my findings · From a simple iframe injection, I upgraded mine to an open redirect.
HackerOne
hackerone.com › reports › 328210
Node.js third-party modules disclosed on HackerOne: [sexstatic]...
I would like to report HTML Injection vulnerability in ```sexstatic``` module. It is possible to use HTML in directory names, which might lead to run arbitrary JavaScript code in the browser. ## Module **module name:** sexstatic **version:** 0.6.2 **npm page:** https://www.npmjs.com/packag...
HackerOne
hackerone.com › reports › 640530
curl disclosed on HackerOne: Insecure Frame (External)
## Summary: [Insecure Frame (External)] ## Steps To Reproduce: [Vulnerability Details identified an external insecure or misconfigured iframe.] Remedy Apply sandboxing in inline frame For untrusted content, avoid the usage of seamless attribute and allow-top-navigation, allow-popups and allow-scripts in sandbox attribute.
Cobalt
cobalt.io › homepage › vulnerability wiki › validation & sanitization exploits › iframe injection
iFrame Injection | Pentest Vulnerability Wiki
April 4, 2022 - <html><head><title>test</title></head><body><iframe width=500 height=500 src="http://169.254.169.254/latest/meta-data/ami-id/"></iframe></body></html>
HackerOne
hackerone.com › reports › 103989
Khan Academy disclosed on HackerOne: Escaping the iframe via...
Several variations on an XSS in the CS platform, involving throwing a malformed error that caused the error buddy to interpret user-provided data as HTML. We now make sure to sanitize all of the messages passed from the iframe before using them.
HackerOne
hackerone.com › reports › 846430
BTFS disclosed on HackerOne: frame injection on bittorrent.com
Hi team, headers.php is injectable. you can see on IE browsers. FULL URL : https://www.bittorrent.com/scripts/site/headers.php?_=1586521900793&callback= ## Impact fix them
YouTube
youtube.com › watch
Bug Bounty Hunting - iframe Injection & HTML Injection - YouTube
Hey guys! welcome to the Bug Bounty Hunting series where we will be learning everything we need to know so that you can begin your journey in Bug Bounty Hunt...
Published May 3, 2019
GitLab
gitlab.com › gitlab.org › #404613
XSS and content injection and iframe injection when viewing raw files on IOS devices (#404613) · Issues · GitLab.org / GitLab · GitLab
April 4, 2023 - ⚠ Please read the process on how to fix security issues before starting to work on the issue. Vulnerabilities must be...
HackerOne
hackerone.com › echidonut › hacktivity
HackerOne
It looks like your JavaScript is disabled. To use HackerOne, enable JavaScript in your browser and refresh this page
HackerOne
hackerone.com › reports › 2964441
Top Echelon Software disclosed on HackerOne: Clickjacking in main...
January 29, 2025 - ## **Summary:** The target website is vulnerable to Clickjacking, a web-based attack that tricks users into interacting with a hidden or disguised iframe. Attackers can exploit this vulnerability to manipulate user actions, potentially leading ...
HackerOne
hackerone.com › reports › 324548
MyCrypto disclosed on HackerOne: Html injection mycrypto.com
Hello. I remembered that a couple of months ago I found an HTML injection vulnerability on myetherwallet.com, I sent it, but my message was ignored. Since you have the same interface, I decided to check this vulnerability on your site and it was reproduced. The vulnerability works both on ...
YouTube
youtube.com › watch
Iframe Injection to SSRF attack and Bypass Forbidden Admin Page | MD2PDF - TryHackMe Walkthrough - YouTube
#TryHackMe #md2pdf#walkthrough About MachineURL: https://tryhackme.com/room/md2pdfHello Hacker!TopTierConversions LTD is proud to announce its latest and gre
Published February 18, 2023
HackerOne
hackerone.com › reports › 319794
Node.js third-party modules disclosed on HackerOne: [m-server] HTML...
However, no escape is implemented which allows malicious user to embed executable JavaScript or HTML code (eg. to load HTML document into ```iframe``` element and execute JavaScript from within loaded file).
HackerOne
hackerone.com › reports › 1537149
Automattic disclosed on HackerOne: XSS and HTML Injection on the...
## Summary: Hi, I have found that search box on pressable.com is vulnerable for XSS attack and HTML Injection . ## Steps To Reproduce: 1. Visit https://pressable.com/knowledgebase/ 2. Put the...