manifests?action=all&format=debug&xss=<script>alert(document.domain);</