security1 distinct publisher
The tag name is the payload: a browser XSS trick filters never think to read
A PortSwigger researcher turns a tag name into executed script by reading its lowercase copy from localName, a spot sanitizers and WAF signatures treat as inert. It reportedly works everywhere.
Publishers:portswigger.net
Reality
- Evidence62
- Adoption
- Insufficient