🎯 New Report #3608199: DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover
🔺Severity: High
👽 Reporter: xavlimsg
⭐️ Reputation: 551
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 500
🕐 Submitted: 2026-03-16
⏰ Disclosed: 2026-04-14 21:36:22
📝 Summary: A DOM XSS vulnerability was discovered in the file import functionality of the Fizzy application. The vulnerability allowed an attacker to craft a malicious filename that, when previewed by the victim user, would inject a second form submission into the import page. This enabled the attacker to perform actions on the victim's account, such as changing the email address, creating a personal access token, and deleting the account, all using the victim's authenticated session.
📂 Report JSON File: 3608199
@hackeronereports