XSS 24
- Exploiting XSS to bypass CSRF defenses
- Exploiting cross-site scripting to capture passwords
- Exploiting cross-site scripting to steal cookies
- Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped
- Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped
- Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped
- Reflected XSS into a JavaScript string with single quote and backslash escaped
- Reflected XSS in canonical link tag
- Reflected XSS with some SVG markup allowed
- Reflected XSS into HTML context with all tags blocked except custom ones
- Reflected XSS into HTML context with most tags and attributes blocked
- Stored DOM XSS
- Reflected DOM XSS
- DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded
- DOM XSS in document.write sink using source location.search inside a select element
- Reflected XSS into a JavaScript string with angle brackets HTML encoded
- Stored XSS into anchor href attribute with double quotes HTML-encoded
- Reflected XSS into attribute with angle brackets HTML-encoded
- DOM XSS in jQuery selector sink using a hashchange event
- DOM XSS in jQuery anchor href attribute sink using location.search source
- DOM XSS in innerHTML sink using source location.search
- DOM XSS in document.write sink using source location.search
- Stored XSS into HTML context with nothing encoded
- Reflected XSS into HTML context with nothing encoded