Questions tagged [xss]

for posts related to cross-site scripting (XSS) vulnerabilities. Instead of posting them publicly, please report security vulnerabilities which affect many users through the contact form at, and include the words "security vulnerability".

Filter by
Sorted by
Tagged with
21 votes
2 answers

How is my browser protected from XSS in Stack Snippets?

Firefox 32.0.2 with NoScript and AdBlockEdge. Steps I have done to enable Stack Snippets: Allowed scripts from http?:// In NoScript settings, went to XSS tab and added exceptions ...
Deer Hunter's user avatar
  • 6,236
4 votes
0 answers

XSS security problems [duplicate]

"><style>.ask-title-cell-value input {background:black;color:white;}</style> This first line is just to demonstrate the XSS. Related bug: <marquee>XSS hole in timeline page</...
joeytje50's user avatar
  • 921
21 votes
1 answer

Auto-suggestions with HTML on stack overflow causes rendering issues

I was entering an issue on Stack Overflow and one of the auto-suggestions had HTML in the title, and it seemed to break the rendering in my browser. I'm using the latest stable FireFox for Windows 8....
Adam Plocher's user avatar
26 votes
2 answers

XSS bug in mobile link

I'm totally frustrated. I reported this using the procedure mentioned in the FAQ but the confirmation email sent me back to the original form. There is XSS on every page of Stack Overflow. Injecting ,...
4 votes
1 answer

Xss behaviour SO api

I have a custom html that pulls the latest SO question via the api: <script type="text/javascript"> function insertReply(content) { output = document.getElementById('...
RickyA's user avatar
  • 143
0 votes
0 answers

Information about Stack Exchange sanitizer for Markdown (XSS)

How does Stack Exchange sanitize the user's text to prevent XSS injections? I've seen that if I write: (this is the doc about this bug) > hello <a name="n" > href="javascript:alert('...
Fez Vrasta's user avatar
12 votes
2 answers

Review history appears not to escape HTML tags in titles of now-deleted questions for users without the privilege to view most deleted questions

I found this bug when looking at my review history. I found that the page shows the title of one of my reviews as: How do I stretch the middle height in a three- layout? In three lines, rather than ...
Peter O.'s user avatar
  • 3,467
-16 votes
1 answer

Potential XSS Vulnerability

I just thought I'd let everyone know that I found a bug in the comments (and possibly questions as well). I went to post a comment in webmasters and I put < noscript > in it and instead of it just ...
SameOldNick's user avatar
6 votes
1 answer

Titles not properly encoded in the /posts/<id>/ajax-load-mini?title=true route

The route used to refresh the question after live update notifications doesn't properly encode the question title, which likely provides a limited opportunity for script injection. In a more ...
Tim Stone's user avatar
  • 58.2k
16 votes
1 answer

XSS on Web site URL of Careers

Edit: Fixed!
YOU's user avatar
  • 25.4k
17 votes
1 answer

XSS in Ask Question page

Copy paste following in browser bar,"><script>alert(1)</script>"&tags="></a></div><script>alert(/1/)</...
YOU's user avatar
  • 25.4k
8 votes
1 answer

HTML in Favorite and Ignored Tags

If you add "'><h1> to either Favorite Tags or Ignored Tags on the home page, it'll insert the HTML into the page and break the page layout. Also, after refreshing the page, some new tags will ...
meze's user avatar
  • 181
15 votes
1 answer

<marquee>XSS hole in timeline page</marquee> - comments are not HTML/XML escaped

See for example here (marquee) and here (input and select). For historical reasons, here's a screen of the last one ;) Related bugs: XSS hole in activity page
user avatar
14 votes
1 answer

xss vulnerability on

A Reddit article with a demonstration of a XSS vulnerability on Unsure if this is duplicate - have searched a handful of ways on meta -- "xss careers" and more, but had no ...
p.campbell's user avatar
  • 1,043
11 votes
1 answer

XSS in the chat room name that are displayed in MSO

The recent chat feature that was added recently has a XSS flaw in it. For testing purpose, I created a chat room called <b>123</b> and as you can see in the screenshot below, the <b> ...
HoLyVieR's user avatar
  • 3,061
7 votes
1 answer

How is input sanitized in the SOFU World?

Is the sanitizer that keeps us safe from nefarious things like <script>alert('evil here');</script> public/available?
Michael Haren's user avatar