🎯 New Report #3644182: Stored XSS in nameserver field on account settings page
🔺Severity: Low
👽 Reporter: axolot23
⭐️ Reputation: 323
🛠 State: resolved
💼 Team: Tucows (VDP)
💵 Bounty: null
🕐 Submitted: 2026-04-02
⏰ Disclosed: 2026-07-31 15:07:21
📝 Summary: A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.
📂 Report JSON File: 3644182
@hackeronereports