Xss

A mutation-XSS that looked like a DOMPurify bug but was really a server-side String.replace breakout, plus an iframe and a cookie-scope trick to read a flag cookie scoped to a path …

A blog rendered user quotes through the Jinja |safe filter and had an admin bot visit them, so a stored XSS payload leaked the bot cookie.

An XSS bot with no filtering at all — a bare alert(1) popped it.

A length-restricted XSS behind a brutal CSP. Multiline JS comments stitched several short injections into one script, which poisoned the admin bot notes, navigated it to where the …

A CSRF/XSS challenge masquerading as SSTI. A script tag on the admin page exfiltrated the bot cookie. First blood.

A web chain: a controllable hash function weakened the nonce, with XSS and a CSRF exfil on top.

The add-testimonial handler in SourceCodester Testimonial Page Manager 1.0 echoes several POST fields without encoding, allowing script injection into the page.

The add-user page in SourceCodester QR Code Login System 1.0 fails to encode the qr-code argument, letting an attacker inject script that runs in a visitor browser.

The add-guest endpoint in SourceCodester Wedding Guest e-Book 1.0 does not encode the name field before displaying it, so an attacker can inject script that runs in a visitor …