XSS
Three characters that walked through the filename filter
The attachment name was escaped on upload but not in the preview. A Unicode normalisation pass did the rest.
· 2 min read $1k - $2.5k
XSS
An avatar that executed on the help desk
SVG accepted as a profile picture, served inline from the same origin, and rendered to whoever opened the ticket.
· 2 min read $500 - $1k