"Stored XSS on /manageappointment.php using the message parameter leading to account takeover" - disclosed by @holybugx , one of many great reports from our first hackevent! View all disclosed reports from the event ->