OkCupid: XSS - okcupid.com

Go to your profile, and go to upload a photo. Add a random description to the photo and upload it. Now go to your photos and go to the latest uploaded photo to edit the description, and paste this : and click Save and you will see the XSS. Regards, Florin...

OkCupid: Stored XSS on your site..

Affected site: http://www.okcupid.com/ Vulnerability:XSS. Severity:Medium/High. Description: Cross site scripting also referred to as XSS is a vulnerability that allows an attacker to send malicious code usually in the form of Javascript to another user. Because a browser cannot know if the scrip...

OkCupid: Stored Cross-site scripting vulnerability in okcupid

Proof of concept : 1. Login into okcupid . 2. Go to profile . 3. In About section , Click on any of the edit icons like MY self summary etc.. 4. Enter payload " 5. Click on save . 6. XSS payload is executed by displaying cookies...

OkCupid: XSS In Profle

URL: http://www.okcupid.com/profile The "First thing people usually notice about me" or any other filed in that page could be set as an XSS by giving it the following string as a value:...

OkCupid: XSS on [okcupid.com]

Hello again, I found another bug that doesn't filter out quotes " or ' at all. I was able to use that to my advantage to get an automatic payload working. Here is the Proof of Concept for that http://www.okcupid.com/profile/808da/questions?search=%22%20AUTOFOCUS%20onfocus=alert%280%29%20%22 I use...

OkCupid: Login destination open redirection

Hi,, I found an open redirection vulnerability, it works when you are signed IN : http://www.okcupid.com/login?dest=http://www.google.com/ Best regards, Olivier Beg...

OkCupid: Direct XSS vulnerabilities (persistent) in http://www.okcupid.com/profile

Direct XSS vulnerabilities persistent in: http://www.okcupid.com/profile Prone to stealing cookies and thereby session hijacking...

OkCupid: https://www.okcupid.com/hidden-users CSRF vulnerability.

Hi, The html code below : Will make it possible to hide an user.. You can patch this by supplying a CSRF token : Best regards, Olivier Beg...

OkCupid: Instagram Authentication - No Request Token

Hello, On OkCupid, you have the ability to connect your Instagram account. This will sync any photos from your account onto your profile. This is performed by browsing to https://www.okcupid.com/okphotos/okinstagram.html, which will redirect to Instagram for the user to authorise the request. Onc...

OkCupid: Users can easily be tricked into changing/disabling privacy and notification settings

The page at www.okcupid.com/settingsis not protected against Cross-Site Request Forgery CSRF attacks. This means that an attacker can trick users into clicking a link, which will immediately change the settings of a user, without the user even being aware of the changes. The attack works like thi...

OkCupid: http://www2.okcupid.com/profile Cross-site scripting

hi, First, go to : http://www2.okcupid.com/profile/evstolia/questions?cf=profile Then type " in the serach input like here: http://prntscr.com/2xlacg. Here a full screenshot : http://prntscr.com/2xlao0 Best regards, Olivier Beg...