Back to Labs
Real World Bug HackerOne #751870 — PUBG — Reflected XSS in HTML Attribute — Low (3.6)
Community Hub

Latest News & Updates

Patch notes, events, and announcements from the PUBG team

Filter:

Showing results for “event”

6 articles
PUBG Update #28.1 — Patch Notes

This patch brings sweeping changes to Erangel, introduces dynamic weather events, and adjusts vehicle damage across all maps. Read the full notes below.

Winter Warfare Event — Limited Time Mode

Drop into the frozen tundra of Vikendi for the Winter Warfare limited time mode. Exclusive cosmetics and weapon skins available for a limited period.

Ranked Season 6 — What's New

Season 6 of Ranked play is here. New tier rewards, updated matchmaking algorithm, and a revised point system aim to create fairer matches at every level.

Anti-Cheat Improvements — November Report

Over 1.2 million accounts banned in November. New machine learning detection models are now active on all live servers. We are committed to fair play.

Weapon Mastery System Expansion

Earn XP for every weapon you use and unlock exclusive cosmetic rewards. The expanded Weapon Mastery system now covers all 40+ weapons in the game.

Survivor Pass: Cold Front — Now Available

The new Survivor Pass includes 90 levels of challenges and rewards, including 2 outfit sets, 3 weapon skins, and the exclusive Snowmobile cosmetic.

Real World Lab — What to Find

This page simulates the PUBG community feed endpoint where the ?p= GET parameter was vulnerable to reflected XSS. Unlike the previous lab, the injection point is NOT inside a JavaScript block — it is inside an HTML attribute.

The search input is safely escaped with htmlspecialchars — but the same parameter is reflected elsewhere on the page without escaping. View the page source and find it. To exploit, you need to break out of the attribute using '>, then inject an HTML tag.

Hint: '><img src=a onerror=alert(document.cookie)>

Platform: HackerOne
Report: #751870
Target: PUBG (pubg.com)
Severity: Low (3.6)
Researcher: 0xfabiof
Status: Resolved (Dec 2019)