Burp suggests that there is a reflection.. It changes a value of a cookie named as x as
I tried a few scripts and looks like characters such as
/ and ; are blocked.
Does this confirm the presence of cross site scripting? How we could actually exploit it? Are there any HTML5 XSS vectors which could be tried here?