The tweet mentions a Reflected XSS bypassing a WAF. The WAF vendor is not specified. For more details, visit the provided link.
For more details, check out the original tweet here: https://twitter.com/cytrusst/status/1871060977447285028