bug-bounty533
xss284
rce166
google121
bragging-post120
exploit103
account-takeover100
open-source91
microsoft87
privilege-escalation79
csrf78
cve77
facebook77
authentication-bypass75
malware74
stored-xss72
access-control65
ai-agents63
reflected-xss61
writeup58
web-security53
ssrf53
input-validation53
sql-injection49
phishing48
cross-site-scripting48
smart-contract46
tool46
defi45
ethereum45
privacy44
web-application43
apple43
cloudflare41
dos39
browser39
information-disclosure39
web338
responsible-disclosure37
llm37
lfi36
burp-suite35
opinion35
api-security35
automation34
oauth34
reverse-engineering34
vulnerability-disclosure34
machine-learning32
idor31
0
7/10
bug-bounty
A stored XSS vulnerability in EspoCRM 5.6.8's email signature feature allowed attackers to steal authentication cookies via a polyglot XSS payload, enabling complete account takeover of any user including administrators. The vulnerability exploited inadequate input sanitization in the markdown code-view feature and lack of HttpOnly flags on session cookies.
stored-xss
account-takeover
cookie-theft
authentication-bypass
httponly-bypass
markdown-injection
html-injection
polyglot-xss
espocrm
bug-bounty
cve-2019-14546
CVE-2019-14546
EspoCRM
EspoCRM 5.6.8
Gaurav Narwani
Somdev Sangwan