DOM-based Vulnerabilities