The <img src=x onerror=…> pattern. Old, ugly, and it still gets through filters that only look for script tags.
An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification.
A stored XSS in PayPal's account name field, delivered to arbitrary users through invoices after bypassing the signup flow's security check by truncating the workflow URL to /webapps/.
A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate.
Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty.
