In an email notification sent to eBay on Friday security researcher Jordan Lee Jones has revealed that he has detected a second vulnerability in eBay's website; and has asserted that the flaw can potentially be exploited for hijacking accounts.

The notification of the second flaw by Jones, a 19-year-old college student from Stockton-on-Tees, UK, comes close on the heels of the disclosure of a major vulnerability which he found in the eBay website last week.

The details of the second vulnerability affecting the eBay website have been published by Jones on his blog. He has also highlighted the fact that, as of Monday (May 26), the vulnerability had not been fixed.

The second vulnerability detected by Jones is a cross-site scripting (XSS) flaw, which results in the execution of another source's code within a website. According to Jones, the flaw can be used for grabbing cookies from logged-in eBay users who visit a page on which the attack code has been injected. The cookies can later be emailed to the attacker.

Noting that a company like eBay should be "on top of their stuff," Jones also demonstrated how the XSS flaw could be used on the eBay website by displaying a pop-up that reads "1337," which - in hacker lingo - means "leet," short for "elite."