I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...