I found a HTML injection vulnerability but there is an issue.

The following request returns the following:

curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<meta name="url:url" content="https://redacted.com/xss/para?meter="><h1>Test\</h1>

enter image description here

But when I try it on a browser it's automatically displaying https://redacted.com/xss/para?meter=%253E%253Ch1%253ETest%253C%2Fh1%253E and response returns the following:

\<meta name="url:url" content="https://redacted.com/xss/para?meter=%253E%253Ch1%253ETest%253C%2Fh1%253E" /\>

enter image description here

So we need to execute this HTML code on victim for an impact. Is there any way for bypass this?

  • Or maybe I should escalate this bug as a server side issue
    – Ugroon
    Jun 20, 2022 at 7:10

2 Answers 2


Do you see this behavior in all browsers? If not, you could abuse it in those specific browsers.

Another method you could try is for instance including the vulnerable page using an <iframe>. This way, the URL does not need to be entered in the browser directly, but only in the src attribute of that iframe.


This is called browser URL encoding, which is now almost supported by every browser, but still, you can try on IE different version I also wanna suggest you a previous discussion here - Bypassing browsers URL encoding to do reflected XSS from query parameter? This surely helps you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .