This site is soon to be deprecated by http://www.johnleitch.net

Monday, April 26, 2010

Stumpleupon.com Reflected XSS

The code that displays spelling corrections does not encode user submitted data.

http://www.stumbleupon.com/search?q=teh<script>alert(0)</script>

3 comments: