PayPal merchant directory reflected XSS
A duplicated q parameter in PayPal’s merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days.
HTTP parameter pollution
A duplicated q parameter in PayPal’s merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days.