I've recently encountered a bug on the https://lua.org/demo.html
webpage. This allows for manipulation of webpage text through the Lua compiler. I ran the code:
print(('Unnatural Lua Behavior\n'):rep(6))
This spams 'Unnatural Lua Behavior' to the output as well as overrides the message at the bottom with repetitions. This likely is open for the ability to run xss within the webpage body.
Hope y'all take care,