Inject page in admin panel via Shopify.API.pushState [New Payload] Analysed #883867 Valid Shopify Cross-site Scripting Low 2020-12-27 $500 20 Kaspersky Protection extension for Google Chrome is vulnerable to abuse its features Analysed #470519 Valid Kaspersky Command and Code Injection Medium 2019-11-25 – 21 Admin bar: Incomplete message origin validation results in XSS Analysed #387544 Valid Shopify Cross-site Scripting Medium 2018-11-07 – 23 Preview bar: Incomplete message origin validation results in XSS Analysed #381192 Valid Shopify Cross-site Scripting Medium 2018-07-26 – 26 xss due to incorrect handling of postmessages Analysed #1758132 Valid Khan Academy Cross-site Scripting Critical 2022-12-23 – 35 RPC Implementation allows unauthenticated remote calls Analysed #876022 Valid Lark Technologies Cross-site Scripting High 2021-02-10 $1,250 39 H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps Analysed #423218 Valid Shopify Cross-site Scripting Medium 2019-11-04 $500 46 Inject page in admin panel via Shopify.API.pushState Analysed #662083 Valid Shopify Cross-site Scripting Low 2019-09-09 $500 51 URL Advisor component in KIS products family is vulnerable to Universal XSS Analysed #463915 Valid Kaspersky Cross-site Scripting High 2019-08-28 – 65 Authorization Token on PlayStation Network Leaks via postMessage function Analysed #826394 Valid PlayStation Misconfiguration and Insecure Design High 2020-11-21 $1,000 74 ██████ DOM XSS via Shopify.API.remoteRedirect Analysed #646505 Valid Shopify Cross-site Scripting Low 2019-09-15 – 76 1 Click to 'Close Account and Refund' via POSTMESSAGE Analysed #1897443 Valid TikTok Access Control Medium 2024-01-03 – 81 DOM XSS on multiple Automattic domains through postMessages Analysed #2371019 Valid Automattic Cross-site Scripting High 2024-02-26 – 92 Reflected XSS on transact.playstation.com using postMessage from the opening window Analysed #900619 Valid PlayStation Cross-site Scripting High 2021-03-30 $1,000 98 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid HackerOne Cross-site Scripting Low 2019-05-04 – 106 Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain Analysed #207170 Valid Slack Misconfiguration and Insecure Design – 2017-02-28 – 120 XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog" Analysed #231053 Valid Shopify Cross-site Scripting – 2017-05-30 $3,000 121 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid HackerOne Cross-site Scripting Medium 2018-08-04 – 129 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP Analysed #207042 Valid HackerOne Misconfiguration and Insecure Design – 2017-08-29 – 153 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid HackerOne Input Validation and Logic Low 2019-04-05 – 154 DOM Based XSS via postMessage at https://inventory.upserve.com/login/ Analysed #603764 Valid Upserve Cross-site Scripting High 2019-06-25 $2,500 171 Access token stealing. Analysed #821896 Valid PlayStation Access Control High 2020-11-21 $1,200 177 DOM Based XSS in www.hackerone.com via PostMessage Analysed #398054 Valid HackerOne Cross-site Scripting Low 2019-02-21 $500 208 Insufficient validation on Digits bridge Analysed #168116 Valid X / xAI Authentication – 2020-08-20 – 263 Bypassing Digits origin validation which leads to account takeover Analysed #129873 Valid X / xAI Authentication – 2020-06-24 – 619