Date:
16 June 2006
Incident Type: Security Breach
WASC Threat Classification: Cross-site Scripting
While XSS vulnerabilities in public web sites are found daily, this one is of special interest. It was found in one of the sites most targeted by Phishers, it is exploitable for Phishing and was exploited. On top of that, it seems to have been discovered and reported to PayPal already two years ago but ignored due to a communication failure.
References:
