PayPal Stored XSS via a Signup Flow Bypass
A stored XSS in PayPal's account name field, delivered to arbitrary users through invoices after bypassing the signup flow's security check by truncating the workflow URL to /webapps/.
Business logic flaw
No injection, no payload. The application's own workflow used against it, like truncating a flow URL to skip the check that was supposed to stop you.