I Found a Bug That Looks Harmless But Can Still Get You Paid (opens in new tab)

Here is everything I know about HTML Injection, how I test for it, how people bypass filters, and what it actually scores on CVSS