I added another vector using an XML data island that does not use CDATA to obfuscate it like the previous version, but instead uses comments. It works in IE and Netscape 8.0 on trusted site settings.

This entry was posted on Thursday, January 1st, 1970 at 12:00 am and is filed under XSS, Webappsec. You can leave a response as well.