[ { "id": "XSS-REFL-001", "payload": "", "tags": [ "basic", "reflected", "quick" ], "expected_block": true, "severity_hint": "High", "notes": "Classic reflected XSS", "category": "XSS" }, { "id": "XSS-REFL-002", "payload": "", "tags": [ "basic", "img", "quick" ], "expected_block": true, "severity_hint": "High", "notes": "Image tag with onerror event", "category": "XSS" }, { "id": "XSS-REFL-003", "payload": "", "tags": [ "svg", "quick" ], "expected_block": true, "severity_hint": "High", "notes": "SVG-based XSS", "category": "XSS" }, { "id": "XSS-REFL-004", "payload": "javascript:alert('XSS')", "tags": [ "protocol", "quick" ], "expected_block": true, "severity_hint": "Medium", "notes": "JavaScript protocol handler", "category": "XSS" }, { "id": "XSS-REFL-005", "payload": "", "tags": [ "body", "event" ], "expected_block": true, "severity_hint": "High", "notes": "Body tag event handler", "category": "XSS" }, { "id": "XSS-REFL-007", "payload": "", "tags": [ "input", "autofocus" ], "expected_block": true, "severity_hint": "High", "notes": "Input with autofocus trigger", "category": "XSS" }, { "id": "XSS-REFL-008", "payload": "%3Cscript%3Ealert('XSS')%3C%2Fscript%3E", "tags": [ "encoded", "basic", "quick" ], "expected_block": true, "severity_hint": "High", "notes": "URL-encoded script tag", "category": "XSS" }, { "id": "XSS-REFL-009", "payload": "ipt>alert('XSS')ipt>", "tags": [ "obfuscation", "evasion" ], "expected_block": true, "severity_hint": "High", "notes": "Tag splitting evasion", "category": "XSS" }, { "id": "XSS-POLY-001", "payload": "jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//\\x3csVg/", "tags": [ "details", "html5" ], "expected_block": true, "severity_hint": "Medium", "notes": "HTML5 details tag", "category": "XSS" }, { "id": "XSS-REFL-011", "payload": "", "tags": [ "marquee", "legacy" ], "expected_block": true, "severity_hint": "Medium", "notes": "Legacy marquee tag", "category": "XSS" }, { "id": "XSS-REFL-012", "payload": "", "tags": [ "mathml", "mutation" ], "expected_block": true, "severity_hint": "High", "notes": "MathML mutation XSS", "category": "XSS" }, { "id": "XSS-POLY-002", "payload": "'\">", "tags": [ "polyglot", "attribute-escape", "quick" ], "expected_block": true, "severity_hint": "Critical", "notes": "XSS polyglot - escapes single quote, double quote, and tag context", "category": "XSS" }, { "id": "XSS-POLY-003", "payload": "javascript:/*-->", "tags": [ "polyglot", "multi-context", "advanced" ], "expected_block": true, "severity_hint": "Critical", "notes": "Advanced XSS polyglot - breaks out of multiple contexts (title, style, textarea, script, xmp)", "category": "XSS" } ]