Tag - cross-site scripting flaw