All VectorsVector nameUser Created Type Likes 34 34 35HTML elements that parse differently when renderedhackvertor4/19/2024XSS1 31 31 31Characters allowed after malformed entitieshackvertor7/1/2024XSS1 34 34 34Characters allowed before slashes which result in an external URLhackvertor1/16/2025XSS1 577 577 577Entities allowed as JS variableshackvertor7/2/2024XSS1 273 29 29Characters allowed within a hostname but don't change the hostnameThomasOrlita4/30/2024JS1 175 175 175Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains0x999-x5/7/2025XSS1 1 1 1Injection in src attribute PORT, characters that change hostnamereindaelman6/15/2025JS1 63.4k 63.4k 63.4kCharacters encoded by encodeURIComponent()JorianWoltjer7/4/2025JS1 1Characters that can break out of an inline style background-image url0xdef1ant7/13/2024XSS1 63.4k 63.4k 63.4kCharacters encoded by encodeURI()JorianWoltjer7/4/2025JS1 12.7k 12.8k 12.7kCharacters after https URI scheme which prevent URL parsing of hrefCillian-Collins10/27/2025XSS1 5 5Characters allowed before after onerror eventst0xodile10/23/2025XSS1 65.4k 65.4k 65.4kCharacters encoded by escape()JorianWoltjer7/4/2025JS1 6 6ToUpperCase Improper Character MorphingIDKdir7/13/2024JS1 82encodeURI() not encoded with %forglockenspielexact7/11/2025JS1JavaScript Scheme starting with httpBinaryScary7/16/2024JS1 1Characters that change length on .toLowerCase()JorianWoltjer4/11/2024JS1 65 65 65Characters matching RegEx /\w/uiJorianWoltjer12/5/2025JS1 16 16masato - braves parsing findingInsertScript8/3/2025XSS1 8 8 8Consuming tagshackvertor4/8/2024HTML1Found 243 recordsPage 11 of 13«45678910111213»
