All VectorsVector nameUser Created Type Likes 1 1 1 1< removal bypassDevice130610/9/2024HTML0 14 14 14Active formatting elementsJorianWoltjer5/1/2024XSS0⚠ Browser differences 121 122 121 120All events on windowhackvertor5/31/2024SINGLE1⚠ Browser differences 92 126 94 71All properties on navigator (two levels of nesting deep)freddyb6/6/2024SINGLE0 6 6 6Allowed characters right after tag name & before tag closure, no other characters in betweenhansmach1ne1/9/2025XSS0 6 6 6 6Attribute separatorshackvertor9/5/2026XSS0⚠ Browser differences 10 9 10 9Attributes that are also DOM propertieshackvertor4/30/2024XSS0 8 8 8 8Before URL protocol relative charactershackvertor8/27/2026XSS0 4 4 4 4Break out of CSS stringshackvertor4/4/2024HTML0 1 1 1 1Bypass __proto__ string match defensevitorfhc8/29/2024JS0 1 1 1Bypasses for __proto__ string matchvitorfhc8/29/2024JS0⚠ Browser differences 1 2 2Bytes that will normalize ISO-2022-JPCillian-Collins12/26/2024XSS1⚠ Browser differences 1 2 2Bytes that will scramble ISO-2022-JPCillian-Collins12/26/2024XSS1 ✓ ✓ ✓ ✓CSS :has() selectorhackvertor7/3/2026FEATURE0 ✓ ✓ ✓ ✓CSS :is() selectorhackvertor7/4/2026FEATURE0⚠ Browser differences 43 33 43 42CSS Properties and functions that make external requestshackvertor8/6/2026XSS0⚠ Browser differences 19 11 19 14CSS Properties that make external requestshackvertor8/6/2026XSS0 6 6 6 6CSS class name separatorshackvertor8/6/2026XSS0 ✓ ✓ ✓ ✓CSS container querieshackvertor7/4/2026FEATURE0⚠ Browser differences 2 1 2 2CSS escapes that cause an external request with a forward slashhackvertor8/6/2026XSS0Found 311 recordsPage 1 of 1612345678910»
