Reflected XSS in `type` parameter on nlsp.nasa.gov

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 30 Oct 2025 2 months ago
Priority P3 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by Marcel_Malaeb

This submission reports a Reflected Cross-Site Scripting (XSS) vulnerability in the type parameter on nlsp.nasa.gov. The vulnerability allows an attacker to inject and execute arbitrary JavaScript in a user’s browser via a crafted URL. It was validated and triaged by Bugcrowd but marked as unresolved by NASA.

Users of this system should ensure proper input sanitization to prevent malicious script execution.

Reflected XSS in `type` parameter on nlsp.nasa.gov

Summary by Marcel_Malaeb

Activity