Valve: Reflected XSS on help.steampowered.com
URL: https://help.steampowered.com/en/wizard/HelpWithGameIssue/?appid=704740&issueid=125&option=%3Ch1%3Eunfiltered It puts option option into a translation token HelpGameMissingItemsTitleuser controlled string here And if there's no such translation token, it just prints out the entire user input...