Vulnerability and POST data

[yvtale]

I just found XSS vulnerability on one website. I have two problems with it
• 1. As like other websites it have two options ONE -LOGIN_ID & PASSWORD and SECOND - Forgot your password.

When I clicked on 'Forgot your password' one field is appearing [like pop-up] when I put XSS vector to that field, This field shows output of vector, [<script>alert('XSSPOSED')</script>] and then print '<XSS_vector> not found in database'. I also tried one Image from internet in this field, this image also appearing means vulnerability is there, but when I tried to find post data of that webpage by FIrebug then webpage shows there is no more POST data requests.
• 2. And second problem is with url. Original vulnerability founded at 'forgot password' option field not on domain_name/login.php but there is not any url for 'forgot password' [they are showing same url i.e.domain_name/login.php]
So if I report it and give it to xssposed like following
* XSS URL: domain_name/login.php
* POST data (application/x-www-form-urlencoded): none
* Cookies: Cookies from website
then is it OK? Unless I will send them video or screenshot of that output [but there is not such upload field in report form] so I don't know what to do ?
I hope you will understand my problem and help me !

Regards,
Yadnyawalkya Tale,
[email protected]

[Spam404Online]

Looks like self XSS which wouldn't be accepted. However, I'd still recommend reporting it to the administrator as it's certainly a bug.

Is your XSS vector included in any of the GET requests? If it is, rarely but worth mentioning, going to the location of that GET request can trigger the XSS and give you a GET to submit

[x1admin]

So if I report it and give it to xssposed like following
* XSS URL: domain_name/login.php
* POST data (application/x-www-form-urlencoded): none
* Cookies: Cookies from website
then is it OK?

we can't approve report without POC code

[tbmnull]

You have to read more, these are not the xss'es as expected.
They are just dust for now, i believe you will learn it soon, till that time, stop posting all screenshots to everywhere please.

[yvtale]

You have to read more, these are not the xss'es as expected.
They are just dust for now, i believe you will learn it soon, till that time, stop posting all screenshots to everywhere please.

Yes sir thanks for suggestion !