New vulnerability class: MaliciousUrl