Stored XSS on 1 target but 2 different endpoints

Hello, Curious as to whether a second submission here is worth it or if I should just add my second finding in the comments. Never had this happen before so looking for some guidance. I found a Stored XSS vuln on a target via body text. Someone opens the page via forum and it leads to full access of victim’s account. Submitted that and waiting triage. Continued testing further and realized the same vuln exists on the file upload on the same target. Again, it leads to full access of victim’s account. Is it worth submitting as a separate report or would it just be marked duplicate? Any advice is appreciated. Thanks! submitted by /u/watkisean [link] [comments]