Waze is currently using its second generation map editing interface. Known as the Waze Map Editor (or WME for short), it is the default editor for Waze since September 19, 2011. This editor interface is internally code-named "Papyrus", and was functionally upgraded on April 21, 2013.
When adding an alternate city and street name was possible to inject a nice XSS.
If I save on the editor all users that click on the street get the XSS.
Next time I will wait 6 months :)
Report: Wed, Jun 26, 2013 at 7:53 PM
Fix: Tue, Jul 02, 2013 at 9:00 PM