I am creating a bug bounty report for a stored cross-site-scripting exploit that can potentially also cause privilege escalation.
The bug bounty program categorizes
Stored XSS as low criticality and
Privilege Escalation as medium criticality. So for privilege escalation you will get a higher bounty.
This is how the exploit works:
- I (as an
adminrole as soon as another admin visits the page (basically I'm just replicating a POST call using the admin's session).
Would this exploit be considered
Stored XSS or