A vulnerability discovered by security researchers Eric Taylor and Blake Welsh could turn an innocuous “refer-a-friend” page into an official-looking phishing page. By adding encoded HTML to the end ...