bug-bounty 2 Reflected XSS in a JSON POST Body (and Why I Almost Ignored It) Sep 6, 2026 I Came for RFI, I Left with SSRF + XSS Jun 17, 2026