LY Corporation: Stored XSS Via Filename On https://partners.line.me/

An XSS vulnerability was found on the file upload feature of "partners.line.me". Attackers could upload a file with an XSS payload in the filename, which was not properly escaped by the server. This allowed for DOM-based XSS to be embedded in HTML. The uploaded files were stored for a limited tim...