LimeSurvey Community 5.3.32 - Stored XSS

Exploit Title: Stored Cross-Site Scripting XSS in LimeSurvey Community Edition Version 5.3.32+220817 Exploit Author: Subhankar Singh Date: 2024-02-03 Vendor: LimeSurvey Software Link: https://community.limesurvey.org/releases/ Version: LimeSurvey Community Edition Version 5.3.32+220817 Tested on:...

Shopify: comment out causes information disclosure

Hi there Go to General setting https://your-domain.myshopify.com/admin/settings/general, set Homepage Title to plus HTML Tag like words. Some data will be leaked in the place of Title in the home page. This is dangerous because sometimes title contains highly confidential data such as carttoken,...