its a free for all of targets known to be vulernable to javascript injection via some route or other?