Report a vulnerability

If you have found a security weakness in a DXS website, product or system, you can tell us about it here. Every report is treated confidentially. Your name and email address are optional, so you can report anonymously if you prefer.

We will acknowledge your report within five working days and aim to complete our assessment within ten working days. Please read our Vulnerability Disclosure Policy before you report.

The form is in English, but reports in other languages are welcome and will be translated.

You can also email your report to security@dxs-systems.co.uk.

Title (optional)For example, reflected cross-site scripting on a named page.

Affected asset (required)The web address, IP address, product name or version where the issue can be seen.

Type of vulnerability (optional)In your own words.

Description (required)What the vulnerability is and what an attacker could achieve.

Steps to reproduce (required)Benign, non-destructive steps that let us reproduce the issue.

Severity (optional)Your own view, with a CVSS vector if you have one.

Data encountered (optional)Optional. Whether you saw any personal data, what it was, and confirmation that you have not shared it and have deleted it.

Attachments (optional)Up to 3 files: PNG, JPG, PDF or plain text, 10 MB maximum each.

Your name (optional)

Your email address (optional)Optional. If you leave this blank we cannot come back to you with questions or tell you when the issue is fixed.

Would you like to be credited publicly if we fix this?

Your personal data. If you give us your name or email address, DXS International plc uses them only to handle your report: to ask you about it, to tell you when it is fixed and, if you ask, to credit you. Both are optional. We keep them for 6 years after the report is closed. See our privacy notice for your rights and how to contact us.