when i added a header X-Forwarded-Host: bing.com it inject meta tags in the site containing bing.com does this have any security impact

<meta property="og:url" content="https://bing.com/argentina"/>

can we inject XSS in it? shall i report for this vulnerability?

shall i put an XSS payload or try redirection or what shall i do?

i have already tried to search in many websites for answer but i couldn't find any


Some meta tags like property og:image can have JavaScript in the property so you can steal cookies or redirect a user or many other Xss attacks

Meta refresh tags can also take a victim to a phishing page that spoofs the real one

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.