I remember using Moodle in middle school. I was a bit of a script kiddie and tried to break it. It had a WYSIWYG editor for responses (obviously not helpful for breaking in), but you could also get at an HTML editor. I put some JS in the HTML editor and saved the response, but the code did not execute when I viewed the page after saving it. But then when I brought up the editor to remove my tampering, the JS executed. It didn't execute on viewing the page, only on attempting to edit it.

I never came up with anything to use that for (thankfully, since I would have gotten caught and punished). It required the person viewing to try to edit my post (which teachers could do but rarely did) and then bring up the hidden HTML editor. But it was the first time I ever found a security vulnerability and I remember it fondly.

This was over ten years ago. I hope it's been patched.