Xss on Youssef Elsayyad — Security Researchhttps://elsayyay.github.io/bounty-blog/tags/xss/Recent content in Xss on Youssef Elsayyad — Security ResearchHugoen-usMon, 22 Jun 2026 00:00:00 +0000A Post Title That Took Over Your Accounthttps://elsayyay.github.io/bounty-blog/posts/post-title-account-takeover/Mon, 22 Jun 2026 00:00:00 +0000https://elsayyay.github.io/bounty-blog/posts/post-title-account-takeover/A post title got reflected into a script tag, which gave me stored XSS. From there I pulled the victim’s session token from an API endpoint and reset their password without the old one. One click, full account takeover.