a code injection inside javascript code can be a headache… But nothing is impossible While we are not working on Pentesting for companies, we love to Bug Hunting on Hackerone. We founded a vulnerable section on a site, with some sort of google analytics code, vulnerable to a URL XSS. …