---
id: 5216
title: "Finding XSS in Salesforce Aura Components: How XBOW Got Creative"
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-salesforce-xss"
published_at: "2025-07-07T12:00:00Z"
tags: ["ai-security", "vulnerability-research", "web-security", "xss", "ai-pentesting", "salesforce", "aura"]
phying_url: "https://phying.com/item/5216"
lang: en
---

# Finding XSS in Salesforce Aura Components: How XBOW Got Creative

## Summary

Chronicles XBOW's XSS discovery in Salesforce Aura components (the /sfsites/aura endpoints) through methodical reconnaissance and creative parameter fuzzing; fixed via coordinated disclosure.

## Intelligence Metadata

- **Sources:** xbow.com
- **Published:** 2025-07-07T12:00:00Z
- **Original:** https://xbow.com/blog/xbow-salesforce-xss
- **Phying News:** https://phying.com/item/5216