tag: Xss

A CSRF vulnerability on ChildsMath’s profile update endpoint that enabled stored XSS via unsanitized name fields. The injected script persisted across every page in the application, and the same request could change the recovery email to execute a full account takeover.

A no-code BJJ tracker built on Base44 enforced all of its authorization in the browser. Here is the chain of six issues that let anyone with a browser read every user’s data, deface the site, and take over accounts.