All VectorsVector nameUser Created Type Likes 1 1 1< removal bypassDevice130610/9/2024HTML0 14 14 14Active formatting elementsJorianWoltjer5/1/2024XSS0⚠ Browser differences 125 122 125 128All events on windowhackvertor5/31/2024JS1⚠ Browser differences 110 118 127 79All properties on navigator (two levels of nesting deep)freddyb6/6/2024JS0 6 6 6Allowed characters right after tag name & before tag closure, no other characters in betweenhansmach1ne1/9/2025XSS0 1 1 1Attribute separatorstr3w5/6/2024HTML0⚠ Browser differences 20 20 20 10Attributes that are also DOM propertieshackvertor4/30/2024XSS0 4 4 4 4Break out of CSS stringshackvertor4/4/2024HTML0 1 1 1Bypass __proto__ string match defensevitorfhc8/29/2024JS0 1 1 1Bypasses for __proto__ string matchvitorfhc8/29/2024JS0 2 2 2Bytes that will normalize ISO-2022-JPCillian-Collins12/26/2024XSS1 2 2 2Bytes that will scramble ISO-2022-JPCillian-Collins12/26/2024XSS1 1 1 1CSS inline property definitionhipotermia3/12/2025HTML0 5 5 5 5Character allowed after onerror eventInsertScript4/2/2024XSS0 1 1 1 1Character that closes HTML tagInsertScript4/2/2024HTML0 46 46 46Characters Allowed Between Protocol // and localhost Where Host Still Equals localhostrootd4ddy3/2/2025JS0 7 7 7 7Characters Supported in </script> Tagsghannu0x012/10/2026XSS0⚠ Browser differences 12.7k 12.7k 12.7k 12.7kCharacters after https URI scheme which prevent URL parsing of hrefCillian-Collins10/27/2025XSS1 16 16 16 16Characters after stringshackvertor4/3/2024JS0 1 1 1 1Characters allowed after * in CSS commentshackvertor3/31/2024HTML0Found 246 recordsPage 1 of 1312345678910»
