All VectorsVector nameUser Created Type Likes 4 4 4 4Entities allowed before slashes which result in an external URLhackvertor1/16/2025XSS0 34 34 34 34Characters allowed before slashes which result in an external URLhackvertor1/16/2025XSS1⚠ Browser differences 48 48 48 32Characters allowed after slashes which result in an external URL hackvertor1/16/2025XSS0 2 2 2 2Characters allowed after colon which result in an external URLhackvertor1/16/2025XSS0 4 4 4 4Entities allowed between slashes using XSS typehackvertor1/16/2025XSS0 5 5 5 5Characters allowed between slashes using XSS typehackvertor1/16/2025XSS0 1 1 1Characters prepended to URL host. check if difference between URL and a tagInsertScript1/10/2025JS0 46 46 46Characters prepended to URL, which yield in the same host propertyInsertScript1/10/2025JS0 47 47 47Characters appended at the end of TLD within URL, which yield in the same host propertyInsertScript1/10/2025JS0 6 6 6Allowed characters right after tag name & before tag closure, no other characters in betweenhansmach1ne1/9/2025XSS0 25 25 25Loose comparison, characters appended which still result in type coercionhansmach1ne1/6/2025JS1 1 1 1Difference between browser-supported handlers and Shazzer 'all_browser_events' listhansmach1ne1/5/2025JS0⚠ Browser differences 24 16 24Difference between browser-supported handlers and Shazzer 'events' listhansmach1ne1/5/2025JS0 47 47 47Characters appended at the end of TLD within URL, which yield in the same Originhansmach1ne1/5/2025JS2 127 127 127HTML TAGS ListsY4tacker1/3/2025XSS0 2 2 2Bytes that will scramble ISO-2022-JPCillian-Collins12/26/2024XSS1 2 2 2Bytes that will normalize ISO-2022-JPCillian-Collins12/26/2024XSS1 30 30 30Characters allowed after equals sign for eventYouGina12/17/2024XSS1 12 12 12Unicode characters that get normalized into path traversal characters hackvertor12/12/2024JS2 2 2 2 2ISO-2022-JP ASCII escape sequencehackvertor12/11/2024XSS1Found 246 recordsPage 4 of 13«12345678910»
