I've recently tested a web application and found out that it was vulnerable to Stored XSS attacks. However, a peculiar behavior left me a bit puzzled. When I inserted John <script>alert(1)</script>Doe, my browser showed that the script tag was indeed injected correctly, but the alert did not pop ...