CVE-2013-2649

The provided text describes a cross-site scripting (XSS) vulnerability in Hero 3.791, where user-supplied input is not properly sanitized. It includes a proof-of-concept URL demonstrating the XSS exploit via the 'username' parameter.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Hero 3.791 by injecting a malicious script via the 'error' parameter in the forgot_password endpoint. The script attempts to steal cookie-based authentication credentials.