tag: Account-Takeover

A CSRF vulnerability on ChildsMath’s profile update endpoint that enabled stored XSS via unsanitized name fields. The injected script persisted across every page in the application, and the same request could change the recovery email to execute a full account takeover.

A critical CSRF vulnerability in a popular reading platform’s email change endpoint that required nothing more than a single click to fully hijack an account.