WS-2017-0186

Using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers...