You could log data about the user (example by captaincrunch in their updated comment), directly modify the way the page looks (e.g. a fake virus alert page) or simply redirect the user to any site you want. It's bad on…
You can also run JS on the page. Try searching for: jv98y4yt47tgfuf4<img src=dhdu4ye.jpg onerror="alert('XSS')">
You could log data about the user (example by captaincrunch in their updated comment), directly modify the way the page looks (e.g. a fake virus alert page) or simply redirect the user to any site you want. It's bad on…
You can also run JS on the page. Try searching for: jv98y4yt47tgfuf4<img src=dhdu4ye.jpg onerror="alert('XSS')">