↓ Skip to main content
An archive hall of identical shelving rows filled with uniform document boxes, receding down a long aisle.
Photo by Viktor Talashuk on Unsplash
  1. Archive/

160 German tax office sites vulnerable to XSS

·1 min
Reflected XSS Coordinated disclosure CERT coordination Government websites
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

We found 160 websites belonging to German tax offices (Finanzämter) vulnerable to reflected cross-site scripting. We passed the information to the German IT news site heise.de, which forwarded it to CERT-Bund, the German government Computer Emergency Response Team.

Disclosure
#

Coverage: heise.de, “Viele Finanzämter mit unsicheren Websites” (German)

The heise.de security news article headlined “Viele Finanzämter mit unsicheren Websites” reporting the cross-site scripting flaws