Stored HTML Injection in “First Name” Field

Stored HTML Injection

While testing a web application’s profile update functionality, I came across a classic but still very dangerous issue: Stored HTML Injection in the First Name field. At first glance, it looked like a normal profile page. The user could edit personal details like first name, surname, and email address. Nothing unusual. But when I tested the First Name input field with […]