| Characters allowed in path traversal | joaxcar | 8/26/2024 | JS | 0 |
| Characters allowed in-between hyphens | hackvertor | 4/14/2024 | XSS | 0 |
| Characters that act as attribute quotes | hackvertor | 5/28/2024 | XSS | 0 |
| Entities allowed between slashes using XSS type | hackvertor | 1/16/2025 | XSS | 0 |
| Characters allowed in colon entity | InsertScript | 9/19/2024 | XSS | 0 |
| Characters that cause the backslash to be consumed with a big5 charset | hackvertor | 11/1/2024 | XSS | 0 |
| Characters urlencoded that get transformed when using the credentials part of the URL | hackvertor | 9/24/2024 | JS | 0 |
| Characters allowed after colon which result in an external URL | hackvertor | 1/16/2025 | XSS | 0 |
| Window properties | hackvertor | 5/31/2024 | JS | 0 |
| Characters allowed before parentheses | hackvertor | 3/31/2024 | JS | 0 |
| Characters that can be inserted in the middle of the JS protocol name | cold-try | 4/15/2024 | XSS | 0 |
 30 | Characters prepended to URL, which yield in the same host property | InsertScript | 1/10/2025 | JS | 0 |
| Tags that get reordered in the DOM | hackvertor | 1/21/2025 | XSS | 0 |
| Malformed HTML comments | hackvertor | 1/17/2025 | XSS | 0 |
| Find WAF bypass for eval context | elieehel | 11/22/2024 | JS | 0 |
 1 | Characters that can be between < and script> | m10x | 11/12/2024 | HTML | 0 |
3 | Characters allowed javascript and colon copy2 copy2 | PinkDraconian | 11/7/2024 | JS | 0 |
| Characters allowed as a class separator | hackvertor | 4/13/2024 | XSS | 0 |
24 | Characters that can be used in eval to write code in between | m-boll | 5/12/2024 | JS | 0 |
| Bypasses for __proto__ string match | vitorfhc | 8/29/2024 | JS | 0 |
