All VectorsVector nameUser Created Type Likes 32 32 32 32Characters allowed before the JavaScript protocolhackvertor1/16/2025XSS0 25 25 25 25Characters allowed after a biginthackvertor7/18/2025JS0 6 6 6Characters allowed before onerror eventshackvertor3/30/2024XSS0 25 25 25 25Characters allowed in-between operatorshackvertor4/14/2024JS2 35 35 35 35Entities still parsed in uppercasehackvertor7/2/2024JS0 2 2 2 2Characters ignored following slash in self closing taghackvertor7/23/2025XSS1 1 1 1 1XSS vectors that execute automatically inside svghackvertor4/17/2024XSS0 2 2 2 2Characters that act as attribute quoteshackvertor5/28/2024XSS0 25 25 25 25Characters ignored in strings when doing a non strict comparisonhackvertor6/18/2024JS0 7 7 7 7Characters ignored in an attribute namehackvertor5/28/2024XSS0 25 25 25 25Characters allowed after throw statementhackvertor7/14/2025JS0 1 1 1 1Properties that leak the parent URL even when sandboxedhackvertor6/6/2024JS0 25 25 25 25Valid space characters in a regexhackvertor12/9/2025JS0⚠ Browser differences 1 18 18 12Entities allowed after slashes on a protocol relative URLhackvertor7/6/2024JS0 1 1 1 1XSS vectors that execute automatically inside mathhackvertor4/17/2024XSS0 18 18 18 18Entities allowed between function call and numberhackvertor7/2/2024XSS0 7 7 7 7Characters Supported in </script> Tagsghannu0x012/10/2026XSS0⚠ Browser differences 123 118 125 79All properties on navigator (two levels of nesting deep)freddyb6/6/2024JS0 2 2 2 2Characters that act as attribute quotes copyfreddyb5/31/2024XSS0 82 82 82 82encodeURI() not encoded with %forglockenspielexact7/11/2025JS1Found 253 recordsPage 8 of 13«3456789101112»
