December 3, 2024 at 1:16 PM
<script>alert(‘XSS injection tonight queen??’)</script>
November 9, 2025 at 3:41 AM
<script>alert(‘XSS injection tonight queen??’)</script>
Additionally, it is vulnerable to XSS
October 8, 2023 at 9:55 PM
Additionally, it is vulnerable to XSS
一步一步被 @xss-cum.bsky.social 调教强制闻自己的球鞋
December 3, 2024 at 11:50 AM
一步一步被 @xss-cum.bsky.social 调教强制闻自己的球鞋
December 11, 2024 at 12:40 PM
I had an XSS issue I wanted fixed quickly, so naturally I had my Bishop fabricate Claims on a neighboring County. Long story short, I have reconstituted the Roman Empire as a vassal state of the Mongol Khanate and I *still* have the XSS issue
January 14, 2026 at 8:09 PM
I had an XSS issue I wanted fixed quickly, so naturally I had my Bishop fabricate Claims on a neighboring County. Long story short, I have reconstituted the Roman Empire as a vassal state of the Mongol Khanate and I *still* have the XSS issue
October 28, 2024 at 6:22 AM
XSS to heap overflow using type confusion to execute code on a remote computer.
Needs XSS to start, no XSS = no window to heap overflow
Needs XSS to start, no XSS = no window to heap overflow
September 26, 2026 at 11:46 PM
XSS to heap overflow using type confusion to execute code on a remote computer.
Needs XSS to start, no XSS = no window to heap overflow
Needs XSS to start, no XSS = no window to heap overflow
June 7, 2025 at 2:46 PM
I’m fucking crying dude. Asking “pretty please do not introduce a security vulnerability”.
April 2, 2026 at 8:06 PM
I’m fucking crying dude. Asking “pretty please do not introduce a security vulnerability”.
September 23, 2025 at 8:38 AM
<script class="xss">$('.xss').parents().eq(1).find('a').eq(1).click();$('[data-action=reskeet]').click();alert('XSS in Skeetdeck')</script>❤️
November 16, 2024 at 12:35 AM
<script class="xss">$('.xss').parents().eq(1).find('a').eq(1).click();$('[data-action=reskeet]').click();alert('XSS in Skeetdeck')</script>❤️
We've updated our XSS cheat sheet to include 9 new vectors from @garethheyes.co.uk! Here are the top three, you can find the rest here: portswigger.net/web-security...
November 10, 2025 at 2:49 PM
We've updated our XSS cheat sheet to include 9 new vectors from @garethheyes.co.uk! Here are the top three, you can find the rest here: portswigger.net/web-security...
⚠️ New #Angular XSS
💡 XSS in i18n attribute bindings
A high-severity XSS security issue affecting i18n attribute bindings has been identified in Angular.
💡 XSS in i18n attribute bindings
A high-severity XSS security issue affecting i18n attribute bindings has been identified in Angular.
March 15, 2026 at 2:35 PM
⚠️ New #Angular XSS
💡 XSS in i18n attribute bindings
A high-severity XSS security issue affecting i18n attribute bindings has been identified in Angular.
💡 XSS in i18n attribute bindings
A high-severity XSS security issue affecting i18n attribute bindings has been identified in Angular.
September 23, 2025 at 8:40 AM
Sehe gerade, wie ein paar „professionelle“ Schwachmaten versuchen, die Sprachwechsel-Parameter einer von mir geschriebenen Webseite mit XSS-Payloads zu füttern.
Immerhin: Für jeden Versuch wechseln sie brav die IP. Fast schon niedlich. 🥹
Immerhin: Für jeden Versuch wechseln sie brav die IP. Fast schon niedlich. 🥹
September 26, 2026 at 2:27 PM
Sehe gerade, wie ein paar „professionelle“ Schwachmaten versuchen, die Sprachwechsel-Parameter einer von mir geschriebenen Webseite mit XSS-Payloads zu füttern.
Immerhin: Für jeden Versuch wechseln sie brav die IP. Fast schon niedlich. 🥹
Immerhin: Für jeden Versuch wechseln sie brav die IP. Fast schon niedlich. 🥹
The Sanitizer API landed in Firefox 148, along with element.setHTML().
This lets you fully configure how HTML strings are cleaned as they're parsed.
hacks.mozilla.org/2026/02/good...
This lets you fully configure how HTML strings are cleaned as they're parsed.
hacks.mozilla.org/2026/02/good...
Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog
Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted…
hacks.mozilla.org
February 24, 2026 at 2:18 PM
The Sanitizer API landed in Firefox 148, along with element.setHTML().
This lets you fully configure how HTML strings are cleaned as they're parsed.
hacks.mozilla.org/2026/02/good...
This lets you fully configure how HTML strings are cleaned as they're parsed.
hacks.mozilla.org/2026/02/good...
Art by Xss (pre-babyfur Loupy), Te'targa, ? (one of the earliest Loupy lamb pictures) and Silver (me as a wolf token for magic)
#babyfur #babyfurs #diaperfur #diaperfurs #diaper #diapers #sissy
#babyfur #babyfurs #diaperfur #diaperfurs #diaper #diapers #sissy
September 27, 2026 at 8:26 AM
Art by Xss (pre-babyfur Loupy), Te'targa, ? (one of the earliest Loupy lamb pictures) and Silver (me as a wolf token for magic)
#babyfur #babyfurs #diaperfur #diaperfurs #diaper #diapers #sissy
#babyfur #babyfurs #diaperfur #diaperfurs #diaper #diapers #sissy
reflected xss too:
twexit.nl/makepretty.p...
twexit.nl/makepretty.p...
October 8, 2023 at 10:53 PM
reflected xss too:
twexit.nl/makepretty.p...
twexit.nl/makepretty.p...
I haven't posted a crazy XSS vector for a while...
Works on every browser
Works on every browser
July 21, 2026 at 8:33 PM
I haven't posted a crazy XSS vector for a while...
Works on every browser
Works on every browser
Got sniped into the challenge and ended up doing some cool XSS research :D
11 char XSS with mind-boggling race-conditions.
TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char)
It's shorter than location=name !!
terjanq.me/solutions/jo...
11 char XSS with mind-boggling race-conditions.
TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char)
It's shorter than location=name !!
terjanq.me/solutions/jo...
December 14, 2024 at 1:17 PM
Got sniped into the challenge and ended up doing some cool XSS research :D
11 char XSS with mind-boggling race-conditions.
TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char)
It's shorter than location=name !!
terjanq.me/solutions/jo...
11 char XSS with mind-boggling race-conditions.
TL;DR the final payload is location=x (10 chars) and the longest is top.Z.x=x.d (11 char)
It's shorter than location=name !!
terjanq.me/solutions/jo...
this is embarrassingly easy xss
September 26, 2026 at 3:05 AM
this is embarrassingly easy xss
We just published an advisory for CVE-2025-32388, a moderate severity XSS vulnerability in SvelteKit. Please update to `@sveltejs/kit@2.20.6`.
The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇
The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇
XSS via tracked search_params
### Summary
Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can ex...
github.com
April 14, 2025 at 6:03 PM
We just published an advisory for CVE-2025-32388, a moderate severity XSS vulnerability in SvelteKit. Please update to `@sveltejs/kit@2.20.6`.
The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇
The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇
June 5, 2025 at 2:18 PM