+- Dark C0d3rs (https://darkcoders.wiki)
+-- Forum: Exploit Log (https://darkcoders.wiki/Forum-Exploit-Log)
+--- Forum: Research Papers/Vulnerability reports (https://darkcoders.wiki/Forum-Research-Papers-Vulnerability-reports)
+--- Thread: HackerOne Disclosed Reports - 2026-02-26 (/Thread-HackerOne-Disclosed-Reports-2026-02-26)
HackerOne disclosed reports - 2026-02-26 - hashXploiter - 02-27-2026
resolved
AI Playground XSS to steal user-chat messages and access to connected MCP Server
Bug reported by Nishant was disclosed at February 26, 2026, 6:56 pm | Cross-site Scripting (XSS) - Reflected
A reflected XSS vulnerability was discovered in the AI Playground OAuth handler due to unescaped interpolation of the error_description parameter into a script tag. The issue has been patched, and users of the open-source Agents SDK should upgrade to v0.3.10.
resolved
HTML Injection in DAST Trial Request Form Confirmation Email – PortSwigger
Bug reported by Jonathan was disclosed at February 26, 2026, 9:19 am |
A vulnerability was discovered in the DAST trial request form on the website, where user input in the "First Name" field was not properly sanitized before being included in confirmation emails. This allowed the injection of arbitrary HTML content, which would be rendered in the recipient's email client.