when i added a header X-Forwarded-Host: bing.com it inject meta tags in the site containing bing.com does this have any security impact

<meta property="og:url" content="https://bing.com/argentina"/>

can we inject XSS in it? shall i report for this vulnerability?

shall i put an XSS payload or try redirection or what shall i do?

i have already tried to search in many websites for answer but i couldn't find any

1 Answer 1


Some meta tags like property og:image can have JavaScript in the property so you can steal cookies or redirect a user or many other Xss attacks

Meta refresh tags can also take a victim to a phishing page that spoofs the real one

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .