I guess I have to add another item to my "reflective XSS exploited in the wild" list (still less than 5 elements though)

https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/

@buherator LOL I have the same bias against reflected XSS 😅

@buherator it's the second I am aware of but I'm out of the loop in regards to breaches nowadays.

@ret2bed Do you have a link? I remember one affecting the issue tracker of Apache, but coldn't find it. I'm thinking about creating a tracking repo similar to AVPWN.

/cc @raptor

@buherator @raptor that was exactly the one I was thinking about. It's been ages. Unfortunately I don't have a link but I can check

@buherator @raptor That was the one I was aware of: https://www.zdnet.com/article/apache-org-hit-by-targeted-xss-attack-passwords-compromised/

@ret2bed @raptor Perfect, thank you!

@buherator @raptor you're welcome!

Zimbra is junk now