Posts following the same line of inquiry.
The stock selector copies storeId from the query string into document.write; closing the option and select lets an encoded image-error payload become executable DOM in the vulnerable lab.
The search page inserts location.search into a document.write tracker string; an encoded quote-closing SVG payload escapes the image attribute and creates an executable handler in the vulnerable lab.
The result div assigns query input through innerHTML: inserted script markup stays inert, while an encoded image-error payload creates a live element and executes its handler in the vulnerable lab.
The feedback page copies returnPath from location.search into the Back link's href with jQuery attr(). Supplying a javascript: URL turns the subsequent click into script execution.
A hashchange handler decodes location.hash and concatenates it into a jQuery :contains() selector. Loading a crafted fragment in an iframe and firing print() drives the vulnerable selector into executable markup.
Unsanitized comment HTML can add username and password inputs that the simulated victim's password manager autofills. JavaScript then sends those credentials to Collaborator before the attacker signs in and deletes Carlos.
A stored comment executes JavaScript for later viewers and can read document.cookie because the session token lacks HttpOnly. Exfiltrating the administrator cookie to Collaborator enables session hijacking and deletion of Carlos.
Stored script runs in the application's origin, fetches /my-account, and extracts the current CSRF token. It can then submit that token with a forged email change, bypassing a defense that remains inaccessible only to cross-origin pages.
The search API reflects input into JSON that client code passes to eval(responseText). Escaping the JSON string and preserving valid syntax converts the reflected value into JavaScript execution in the browser.
The raw query string enters the href attribute of a canonical link in the document head. An injected accesskey and onclick handler exploit that attribute context even though angle brackets cannot create another element.
Search input is embedded in a single-quoted JavaScript string while angle brackets are HTML-encoded. An unescaped quote terminates the string, allowing a syntactically valid statement to execute.
The page escapes single quotes with backslashes but leaves attacker-supplied backslashes untouched. Escaping the escape character restores control of the surrounding JavaScript string and permits code execution.