Filters apply as you choose them.
Cognitoys Dino devices allow XSS via the SSID.
Cognitoys Dino devices allow profiles_add.html CSRF.