The developer filter the characters
= and the vulnerability is something like:
I also tried URL encodes like
%0a but it doesn't work. Without filters I can get XSS like
Any ideas about how to bypass?