Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

However, there is a vulnerability in the way the URI fragment is interpreted by this site. The site updates the page number directly from the URI fragment, without checking the contents.

Dangerous use of innerHTML
JavaScript 
window.addEventListener('load', () => {
  const page = window.location.hash.slice(1);
  loadPage(page);

  document.getElementById('page-no').innerHTML = page;
});