This question already has an answer here:
- Style attribute XSS without quotes 1 answer
I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website.
I understand that this is potentially a tool for csrf or stealing url parameters. But on its own, should it be considered a security vulnerability?
edit: Question is primarily about whether this is a vulnerability in its own right, rather than how this could possibly be used to create further exploits.