All VectorsVector nameUser Created Type Likes 1 1 1Includes Validation Chars AllowedSimpsonpt10/8/2024JS1 1 1 1Entities in-between square brackets that close cdatahackvertor10/8/2024XSS1 19 19 19HTML tags and attributes that can be used to access the URL0x999-x11/4/2024XSS1 1 1 1Chars that can be used as opening bracket in innerHTMLnollium4/19/2025JS1 175 175 175 175Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains0x999-x5/7/2025XSS1 30 30 30Characters allowed after equals sign for eventYouGina12/17/2024XSS1 1 1 1 1Injection in src attribute PORT, characters that change hostnamereindaelman6/15/2025JS1 63.4k 63.4k 63.4k 63.4kCharacters encoded by encodeURIComponent()JorianWoltjer7/4/2025JS1 8 8 8 8Consuming tagshackvertor4/8/2024HTML1 25 25 25Loose comparison, characters appended which still result in type coercionhansmach1ne1/6/2025JS1 63.4k 63.4k 63.4k 63.4kCharacters encoded by encodeURI()JorianWoltjer7/4/2025JS1 1 1 1 1Characters allowed in-between hyphenshackvertor4/14/2024XSS1 5 5 5 5Characters allowed before after onerror eventst0xodile10/23/2025XSS1 1 1 1 1masato - braves parsing findingInsertScript8/3/2025XSS1 2 2 2 2Characters ignored following slash in self closing taghackvertor7/23/2025XSS1 65.4k 65.4k 65.4k 65.4kCharacters encoded by escape()JorianWoltjer7/4/2025JS1 82 82 82 82encodeURI() not encoded with %forglockenspielexact7/11/2025JS1 31 31 31 31Characters allowed after malformed entitieshackvertor7/1/2024XSS1 1 1 1 1masato - braves parsing finding valid charactersInsertScript8/3/2025XSS1⚠Browser differences 34 35 34 34HTML elements that parse differently when renderedhackvertor4/19/2024XSS1Found 253 recordsPage 11 of 13«45678910111213»
