CWE-85
Doubled Character XSS Manipulations
The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
Impactr finds and proves whether CWE-85 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.