All VectorsVector nameUser Created Type Likes 1 1 1Chars that can be used as opening bracket in innerHTMLnollium4/19/2025JS1 2 2 2char not urlencoded (data)nu11secur1ty9/29/2024JS0 1 1 1domain valuesnu11secur1ty9/29/2024JS0 157 157 157char not urlencoded (data+)nu11secur1ty9/29/2024JS0 1HTML vector nu11secur1ty9/29/2024HTML0 1 1 1worknu11secur1ty9/29/2024HTML0 7 7 7 7Characters that close or encapsulate HTML attribute valuesola45611/5/2024XSS1 1 1 1Characters ending XML Processing Instructions (WIP)ola4562/4/2025XSS0 5 5 5 5Characters that end unencapsulated HTML attribute valuesola4565/14/2025XSS0 7 7 7 7Closing title tag name separatorsola4569/15/2025XSS0 1 1 1Characters allowed to break double quotesp3n7a90n6/30/2024XSS0 1 1 1Decimal separators in parseFloatpiprett5/17/2026JS0 25 25String trim whitepace characterspiprett5/16/2026JS1⚠Browser differences 32 32 32 33Characters that can precede the javascript protocol copyrcbarnett5/2/2024XSS0 1 1 1 1Characters appended at the end of PORT within URL, which yield a different HOSTreindaelman6/15/2025JS0 1 1 1 1Injection in src attribute PORT, characters that change hostnamereindaelman6/15/2025JS1 3 3 3 3Characters allowed javascript and colonrenniepak4/9/2024JS4 1 1 1Impossible lab framesetrenniepak11/27/2024HTML0 32 32 32 32Characters that can precede the javascript protocolrenniepak4/10/2024XSS4 46 46 46Characters Allowed Between Protocol // and localhost Where Host Still Equals localhostrootd4ddy3/2/2025JS0Found 255 recordsPage 12 of 13«45678910111213»
