I found a reflected XSS on the cubers.io domain. This can steal cookies from other users or perform phishing attacks (not sure if it can take over accounts since you're using OAuth from WCA, but if it is, then the attacker can get the WCA account of the victim).
Mitigation/fix: Filter the tags that are being sent using the parameter from /event/{param}, or just show a 404 error.
Vulnerable url: https://www.cubers.io/event/{param}
Payload:
https://www.cubers.io/event//
I found a reflected XSS on the cubers.io domain. This can steal cookies from other users or perform phishing attacks (not sure if it can take over accounts since you're using OAuth from WCA, but if it is, then the attacker can get the WCA account of the victim). Mitigation/fix: Filter the tags that are being sent using the parameter from /event/{param}, or just show a 404 error. Vulnerable url: https://www.cubers.io/event/{param} Payload: https://www.cubers.io/event/
/