## Summary: When visiting runpanther.io I got redirected to panther.com and the application failed to sanitise user's input resulting into HTML injection and possible XSS. ## Steps To Reproduce: {F1774502} 1. Go to https://panther.com/search/Users%3Ch1%3EHello,%20I%20am%3C/h1%3E%3Cfont%20color=red%3E%20Ibrahimatix0x01%3C/font%3E 1. You will notice that HTML codes in the search form are executed by the browser. ## Supporting Material/References: {F1774497} ## Impact The vulnerability allow a malicious user to inject html tags and could possibly execute Javascript (if WAF is successfully bypassed)which could lead to steal user's session

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)