Shopify: URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify Linkpop

The Shopify Linkpop service was found vulnerable to a cache poisoning issue that allowed attackers to manipulate the display of Amazon affiliate products. By crafting malicious URLs, attackers could trick victims into linking to the attacker's products instead of the intended ones. This...

Shopify: Self XSS in https://linkpop.com/dashboard/admin

Summary: Hello Shopify team, Found a self XSS https://linkpop.com/dashboard/admin, the steps to reproduce are below Steps To Reproduce: 1- Visit https://linkpop.com/dashboard/admin 2- Click on links = add links 3- add in the url input javascript:alertdocument.cookie F1757141 4- Click on the link...

Shopify: XSS seems to work again after change to linkpop at https://linkpop.com/testnaglinagli

Summary My XSS seems to work again at https://linkpop.com/testnaglinagli Best Regards @nagli Impact XSS...