🎯 New Report #3802451: HTML Injection in Contact Form Email Enables Phishing via Legitimate ████████ Infrastructure
🔺Severity: Medium
👽 Reporter: tenzai
⭐️ Reputation: 1445
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-06-14
⏰ Disclosed: 2026-10-05 11:34:09
📝 Summary: An HTML injection vulnerability was discovered in a contact form email endpoint. The firstName field was rendered as unescaped HTML in transactional confirmation emails sent via SendGrid. Anchor tags with inline styles were not sanitized and persisted in email clients, allowing styled links to be injected into legitimate branded emails. The endpoint accepted requests without authentication, CAPTCHA, or rate limiting. Image tags were stripped by the email pipeline, but anchor tags survived with attacker-controlled styling and href attributes that were rewritten through SendGrid's click tracking proxy.
📂 Report JSON File: 3802451
@hackeronereports