| Characters not urlencoded when using the credentials part of the URL | hackvertor | 5/28/2024 | JS | 1 |
| Characters in-between square brackets that close cdata | hackvertor | 10/8/2024 | XSS | 0 |
| Characters ignored in strings when doing a non strict comparison | hackvertor | 6/18/2024 | JS | 0 |
| Characters ignored in an attribute name | hackvertor | 5/28/2024 | XSS | 0 |
| Characters ignored after backslash with multiline string | hackvertor | 6/18/2024 | JS | 0 |
| Characters ending XML Processing Instructions (WIP) | ola456 | 2/4/2025 | XSS | 0 |
 7  7 | Characters between element name and > | ThomasOrlita | 4/15/2024 | HTML | 0 |
1 1 | Characters between < and element name | ThomasOrlita | 4/15/2024 | HTML | 1 |
31 | Characters appended at the end of TLD within URL, which yield in the same host property | InsertScript | 1/10/2025 | JS | 0 |
275 | Characters appended at the end of TLD within URL, which yield in the same Origin | hansmach1ne | 1/5/2025 | JS | 2 |
| Characters allowed within a hostname but don't change the hostname | ThomasOrlita | 4/30/2024 | JS | 1 |
| Characters allowed to end a JS string | sqjor | 7/17/2024 | JS | 0 |
1 | Characters allowed to break double quotes | p3n7a90n | 6/30/2024 | XSS | 0 |
 3 | Characters allowed javascript and colon copy2 copy2 | PinkDraconian | 11/7/2024 | JS | 0 |
4 | Characters allowed javascript and colon copy2 | avlidienbrunn | 9/29/2024 | JS | 0 |
3 3 | Characters allowed javascript and colon | renniepak | 4/9/2024 | JS | 3 |
1 | Characters allowed instead of equal sign | c3l3si4n | 4/28/2024 | XSS | 0 |
| Characters allowed in-between operators | hackvertor | 4/14/2024 | JS | 2 |
| Characters allowed in-between hyphens | hackvertor | 4/14/2024 | XSS | 1 |
| Characters allowed in the protocol that still resolve host name | hackvertor | 5/6/2025 | JS | 0 |
