https://moza369.github.io/tags/email/Recent content in Email on MOZAHugoen-usThu, 13 Nov 2025 00:00:00 +0000https://moza369.github.io/writeups/html-injection-email-notifications/Thu, 13 Nov 2025 00:00:00 +0000https://moza369.github.io/writeups/html-injection-email-notifications/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Car marketplace platform</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>HTML Injection in Email</td> </tr> <tr> <td><strong>Status</strong></td> <td>Triaged</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>I found this one while testing a car seller form on a marketplace platform. The <code>First Name</code> field caught my attention — when I submitted HTML tags, they got <strong>rendered in the email notification</strong> I received.</p> <p>At first, I didn&rsquo;t report it. HTML injection in emails often gets closed as informative, and I didn&rsquo;t want to waste anyone&rsquo;s time.</p>