XSS flaws