3 ms·

<a href="javascript:alert('vulnerability found')">click here</a> This is working, but I suppose it shouldn't