Script alert xss script. Картинка/<script>alert('xss')</script>. <script>alert('xss')</script> в url запросе.