1
1
1It occurs within a frameset but before a body tag with equals filtered. You would think you could inject a closing frameset followed by a script block but that would be too easy.
<!doctype HTML>
<html>
<head>
<title>After Frameset when exists before body and no equals</title>
<frameset></$[data1]>
<found><$[data2]></frameset>
</body>
</html>