Active XSS flaw discovered on eBay

According to XSSed, Shubham Upadhyay has discovered an active XSS flaw affecting


According to XSSed, Indian security researcher Shubham Upadhyay has discovered an active XSS flaw affecting

The potential attacker would need an Ebay seller account, where he would put XSS code into the HTML. The vulnerability could be used to trick users into trusting's reputable Web position in an attempt to serve client-side exploits to them. And that's just for starters. is a popular target for malicious attackers, looking for ways to abuse and hijack the steady inflow of traffic hitting the site on a daily basis, and security researchers who on the other hand attempt to prevent abuse of the site by discovering and reporting security vulnerabilities to Ebay's Security Team.

Mozilla Firefox's NoScript proactively detects the XSS attempt, and blocks it.

The XSS flaw remains unfixed for the time being. eBay's Security Team has been notified.

Find out more about Dancho Danchev at his LinkedIn profile.


You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
See All
See All