cspshivam/playground
XSS Level 9 / 10 Medium
← All labs

Sink — Event Handlers

Angle brackets survive but "script" is banned. Fire a handler that runs on its own.

Photo caption

Add a caption. HTML is allowed, but we strip the word script.

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.