+- Dark C0d3rs (https://darkcoders.wiki)
+-- Forum: Exploit Log (https://darkcoders.wiki/Forum-Exploit-Log)
+--- Forum: Research Papers/Vulnerability reports (https://darkcoders.wiki/Forum-Research-Papers-Vulnerability-reports)
+--- Thread: HackerOne Disclosed Reports - 2025-03-13 (/Thread-HackerOne-Disclosed-Reports-2025-03-13)
HackerOne disclosed reports - 2025-03-13 - hashXploiter - 03-14-2025
resolved
Stored Cross-Site Scripting in mercadopago.com.ar
Bug reported by El Mago was disclosed at March 13, 2025, 7:53 pm | Cross-site Scripting (XSS) - Stored
The summary is as follows: A stored cross-site scripting vulnerability was discovered in mercadopago.com.ar. The issue was acknowledged and addressed by MercadoLibre internally.
resolved
Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile
Bug reported by Sarthak Raju Bhingare‎ was disclosed at March 13, 2025, 5:34 pm | Violation of Secure Design Principles
The domain highlighting functionality on the External Link Warning interstitial page was not working as intended on the Chrome and Microsoft Edge mobile browsers. The issue was reported to have been previously fixed by HackerOne, but it appears to have resurfaced. The vulnerability could have potentially allowed malicious actors to trick users into believing they were being redirected to a legitimate website when in reality they were being redirected to a malicious site.
resolved
cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party
Bug reported by floyd was disclosed at March 13, 2025, 3:44 pm | Information Disclosure
The windmail.exe application in the CGI scripts wordlist had a vulnerability that allowed an attacker to read arbitrary files on the server and send the contents to a third-party email address.