Mail cross site scripting collection