All categories
Browser Quirks
CSS Parsing
Character Encoding
DOM Behavior
Entity Parsing
HTML Parsing
JavaScript Syntax
Regular Expressions
URL Handling
Web APIs
XML Parsing
XSS Execution
Login
Home
Vectors
Categories
All vectors
All collections
Browser diffs
RSS
Stats
Performance
Features
Differences
Releases
Network
Tools
Cheat sheet
Unicode table
Blog
Blog home
RSS
What's new
Help
Home
Vectors
Categories
All vectors
All collections
Browser diffs
RSS
Stats
Performance
Features
Differences
Releases
Network
Tools
Cheat sheet
Unicode table
Blog
Blog home
RSS
What's new
Help
Testing...
disconnected
Distributed Fuzzing
Enabled:
Status:
disconnected
Open fuzz launcher
Your browser automatically contributes to distributed fuzzing when idle. The launcher keeps fuzzing going while you use other tabs.
Advanced
All categories
Browser Quirks
CSS Parsing
Character Encoding
DOM Behavior
Entity Parsing
HTML Parsing
JavaScript Syntax
Regular Expressions
URL Handling
Web APIs
XML Parsing
XSS Execution
All Vectors
Vector name
User
Created
Type
Likes
1
1
1
1
Properties that contain URLs
hackvertor
5/31/2024
SINGLE
2
18
18
18
18
Entities after protocol-relative URL
hackvertor
4/3/2026
JS
2
2k
2k
2k
2k
Characters that cause exceptions when URL encoded
hackvertor
10/3/2024
JS
2
106
106
106
106
Named HTML entities that can be closed with !
avlidienbrunn
7/29/2025
XSS
2
25
25
25
25
Characters allowed after optional chaining
hackvertor
5/4/2024
JS
2
25
25
25
25
String trim whitepace characters
piprett
5/16/2026
JS
2
⚠ Browser differences
67
65
67
67
Characters allowed inside javascript protocol and still returns the hostname
RenwaX23
7/21/2025
JS
3
4
4
4
4
Characters that cause an external URL before @
hackvertor
9/25/2024
JS
3
299
299
299
299
Characters appended at the end of TLD within URL, which yield in the same Origin
hansmach1ne
1/5/2025
JS
3
7
7
7
7
Characters allowed while closing script tag
AyushXtha
10/27/2025
XSS
3
4
4
4
4
Entities that cause an external URL before @
hackvertor
9/25/2024
XSS
4
32
32
32
32
Characters that can precede the javascript protocol
renniepak
4/10/2024
XSS
4
302
302
302
302
Characters allowed between hostname and / but don't change the hostname
ThomasOrlita
4/15/2024
JS
4
50
50
50
50
HTML entities that create ASCII characters inside a JavaScript URL
hackvertor
6/25/2024
JS
4
1
1
1
1
JavaScript Scheme starting with https://
BinaryScary
6/28/2024
JS
4
3
3
3
3
Characters allowed javascript and colon
renniepak
4/9/2024
JS
4
5
5
5
5
Characters allowed between multiple HTML attributes
JorianWoltjer
9/12/2024
XSS
4
4
4
4
4
URL domain dot alternatives
JorianWoltjer
9/10/2024
JS
5
Found
318
records
Page 16 of 16
«
7
8
9
10
11
12
13
14
15
16