Spot the Vuln

A small code snippet. Click the line you think is vulnerable. One new snippet every day at 00:00 UTC. We don’t record your clicks.

JavaScript Spot the XSS

1const params = new URLSearchParams(location.search);2const name = params.get('name');3const greeting = document.getElementById('hello');4greeting.innerHTML = `Welcome back, ${name}!`;5fetch('/api/track', { method: 'POST', body: JSON.stringify({user: name}) });