 275 | Characters appended at the end of TLD within URL, which yield in the same Origin | hansmach1ne | 1/5/2025 | JS | 2 |
15 | Characters appended at the end of PORT within URL, which yield a different HOST | reindaelman | 6/15/2025 | JS | 0 |
| Characters allowed within a hostname but don't change the hostname | ThomasOrlita | 4/30/2024 | JS | 1 |
| Characters allowed to end a JS string | sqjor | 7/17/2024 | JS | 0 |
1 | Characters allowed to break double quotes | p3n7a90n | 6/30/2024 | XSS | 0 |
4  4 | Characters allowed javascript and colon copy2 | avlidienbrunn | 9/29/2024 | JS | 0 |
| Characters allowed javascript and colon | renniepak | 4/9/2024 | JS | 3 |
1  1 | Characters allowed instead of equal sign | c3l3si4n | 4/28/2024 | XSS | 0 |
| Characters allowed inside javascript protocol and still returns the hostname | RenwaX23 | 7/21/2025 | JS | 1 |
| Characters allowed in-between operators | hackvertor | 4/14/2024 | JS | 2 |
| Characters allowed in-between hyphens | hackvertor | 4/14/2024 | XSS | 1 |
| Characters allowed in the protocol that still resolve host name | hackvertor | 5/6/2025 | JS | 0 |
| Characters allowed in path traversal | joaxcar | 8/26/2024 | JS | 0 |
| Characters allowed in colon entity | InsertScript | 9/19/2024 | XSS | 0 |
| Characters allowed either side of a variable assignment | hackvertor | 7/18/2025 | JS | 0 |
25 25 | Characters allowed between variable name and equals sign | 0x999-x | 4/9/2024 | JS | 0 |
| Characters allowed between slashes using XSS type | hackvertor | 1/16/2025 | XSS | 0 |
3 | Characters allowed between slashes | hackvertor | 4/8/2024 | JS | 0 |
5 | Characters allowed between multiple HTML attributes | JorianWoltjer | 9/12/2024 | XSS | 2 |
| Characters allowed between in operator | hackvertor | 4/3/2024 | JS | 0 |
