Yahoo Pipes was full of XSS vulns. I used to play with cookie grabbers