All VectorsVector nameUser Created Type Likes 5 5 5 5Character allowed after onerror eventInsertScript4/2/2024XSS0 1 1 1Characters prepended to URL host. check if difference between URL and a tagInsertScript1/10/2025JS0 1 1 1characters allowed between exclamation mark and greater then InsertScript6/18/2024HTML0 65.4k 65.4k 65.4k 65.4kCharacters encoded by escape()JorianWoltjer7/4/2025JS1 65.5k 65.5k 65.5k 65.5kCharacters allowed in middle of HTML tag nameJorianWoltjer1/30/2026XSS1 63.4k 63.4k 63.4k 63.4kCharacters encoded by encodeURI()JorianWoltjer7/4/2025JS1 53 53 53 53Characters allowed as start of HTML tag nameJorianWoltjer1/30/2026XSS1⚠ Browser differences 2 1 2JIS X 0208 bytes that produce ASCII charactersJorianWoltjer9/22/2024JS1 5 5 5Characters allowed between multiple HTML attributesJorianWoltjer9/12/2024XSS4 4 4 4 4URL domain dot alternativesJorianWoltjer9/10/2024JS5 63.4k 63.4k 63.4k 63.4kCharacters encoded by encodeURIComponent()JorianWoltjer7/4/2025JS1 14 14 14Active formatting elementsJorianWoltjer5/1/2024XSS0 1 1 1Characters that change length on .toLowerCase()JorianWoltjer4/11/2024JS1⚠ Browser differences 1.4k 1.4k 1.4k 1.4kUnicode "Latin" characters using \p{scx=Latin} RegExJorianWoltjer12/5/2025JS0 65 65 65 65Characters matching RegEx /\w/uiJorianWoltjer12/5/2025JS1 48 48 48Scheme slash alternatives in URL() when a base is usedN25sec5/22/2025JS0 1 1 1 1dsqdNikolaT3esla10/1/2025HTML0 1 1 1 1Electron XSS TESTP4rkJW10/22/2025HTML0 4 4 4Characters allowed before the JavaScript protocol colonRemakingEden3/3/2025XSS0⚠ Browser differences 67 65 67 67Characters allowed inside javascript protocol and still returns the hostnameRenwaX237/21/2025JS3Found 248 recordsPage 3 of 13«12345678910»
