All VectorsVector nameUser Created Type Likes 31 31 31 31Characters allowed either side of a variable assignmenthackvertor7/18/2025JS0 1.1M 1.1M 1.1M 1.1MCharacters encoded by encodeURIComponent()JorianWoltjer7/4/2025JS1 3 3 3 3Characters that act as array literalshackvertor6/24/2024JS0⚠ Browser differences 18 18 18 12Entities allowed after slashes on a protocol relative URLhackvertor7/6/2024JS0 6 6 6ToUpperCase Improper Character MorphingIDKdir7/13/2024JS1⚠ Browser differences 15 15 15 9Entities allowed inside hosthackvertor7/6/2024JS0 40 40 40 40JavaScript Scheme starting with httpBinaryScary7/16/2024JS1 1 1 1React DOM srcIDKdir7/15/2024JS0 1 1 1 1Characters allowed before event in attribute name using setAttributehackvertor8/21/2024JS0 1 1 1 1Characters appended at the end of PORT within URL, which yield a different HOSTreindaelman6/15/2025JS0 1 1 1Bypasses for __proto__ string matchvitorfhc8/29/2024JS0 1 1 1 1Characters allowed to end a JS stringsqjor7/17/2024JS0 4 4 4 4URL domain dot alternativesJorianWoltjer9/10/2024JS5 2 2 2char not urlencoded (data)nu11secur1ty9/29/2024JS0 4 4 4 4Characters allowed javascript and colon copy2avlidienbrunn9/29/2024JS0 332 332 332 332Characters allowed after hostname but don't change the hostnameThomasOrlita4/15/2024JS2 1.1M 1.1M 1.1M 1.1MDifferences between escape vs encodeURIComponenthackvertor10/15/2024JS1 1 1 1 1Injection in src attribute PORT, characters that change hostnamereindaelman6/15/2025JS1 12 12 12 12Unicode characters that get normalized into path traversal characters hackvertor12/12/2024JS2 299 299 299 299Characters appended at the end of TLD within URL, which yield in the same Originhansmach1ne1/5/2025JS3Found 314 recordsPage 10 of 16«567891011121314»
