[ {"id":"xss-ev-001","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["img","onerror"],"notes":"Classic img onerror","expected_block":true}, {"id":"xss-ev-006","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["img","onerror","no-space"],"notes":"Slash instead of space","expected_block":true}, {"id":"xss-ev-007","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["img","charcode","evasion"],"notes":"String.fromCharCode bypass","expected_block":true}, {"id":"xss-ev-008","payload":"","category":"xss","method":"GET","severity_hint":"critical","tags":["input","autofocus"],"notes":"Autofocus triggers onfocus","expected_block":true}, {"id":"xss-ev-009","payload":"","category":"xss","method":"GET","severity_hint":"critical","tags":["input","onblur"],"notes":"Dual input onblur trick","expected_block":true}, {"id":"xss-ev-010","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["textarea","autofocus"],"notes":"Textarea autofocus","expected_block":true},
  {"id":"xss-ev-012","payload":"<keygen autofocus onfocus=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["keygen","autofocus"],"notes":"Deprecated keygen element","expected_block":true},
  {"id":"xss-ev-013","payload":"<video><source onerror=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["video","source","onerror"],"notes":"Video source error","expected_block":true},
  {"id":"xss-ev-014","payload":"<video src=x onerror=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["video","onerror"],"notes":"Video direct onerror","expected_block":true},
  {"id":"xss-ev-015","payload":"<audio src=x onerror=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["audio","onerror"],"notes":"Audio onerror","expected_block":true},
  {"id":"xss-ev-016","payload":"<body onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["body","onload"],"notes":"Body onload event","expected_block":true},
  {"id":"xss-ev-017","payload":"<body onpageshow=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["body","onpageshow"],"notes":"Body pageshow event","expected_block":true},
  {"id":"xss-ev-018","payload":"<body onhashchange=alert(1)><a href=#>click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["body","onhashchange"],"notes":"Hash change trigger","expected_block":true},
  {"id":"xss-ev-019","payload":"<marquee onstart=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["marquee","onstart"],"notes":"Marquee onstart event","expected_block":true},
  {"id":"xss-ev-020","payload":"<details open ontoggle=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["details","ontoggle"],"notes":"Details ontoggle auto-fire","expected_block":true},
  {"id":"xss-ev-021","payload":"<meter onmouseover=alert(1)>0</meter>","category":"xss","method":"GET","severity_hint":"high","tags":["meter","mouseover"],"notes":"Meter element event","expected_block":true},
  {"id":"xss-ev-022","payload":"<object data=javascript:alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["object","javascript-uri"],"notes":"Object with JS URI","expected_block":true},
  {"id":"xss-ev-023","payload":"<embed src=javascript:alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["embed","javascript-uri"],"notes":"Embed with JS URI","expected_block":true},
  {"id":"xss-ev-024","payload":"<a href=javascript:alert(1)>click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","javascript-uri"],"notes":"Classic javascript: URI","expected_block":true},
  {"id":"xss-ev-025","payload":"<a href=jaVasCrIpT:alert(1)>click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","case-variation"],"notes":"Mixed case javascript:","expected_block":true},
  {"id":"xss-ev-026","payload":"<a href=java%0ascript:alert(1)>click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","newline-inject"],"notes":"Newline in javascript:","expected_block":true},
  {"id":"xss-ev-027","payload":"<a href=java%09script:alert(1)>click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","tab-inject"],"notes":"Tab in javascript:","expected_block":true},
  {"id":"xss-ev-028","payload":"<a href=java%0dscript:alert(1)>click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","cr-inject"],"notes":"CR in javascript:","expected_block":true},
  {"id":"xss-ev-029","payload":"<a href=\"javascript:alert(1)\">click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","html-entity"],"notes":"HTML entity encoded javascript:","expected_block":true},
  {"id":"xss-ev-030","payload":"<a href=\"javascript:alert(1)\">click</a>","category":"xss","method":"GET","severity_hint":"critical","tags":["anchor","hex-entity"],"notes":"Hex entity javascript:","expected_block":true},
  {"id":"xss-ev-031","payload":"<iframe src=javascript:alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["iframe","javascript-uri"],"notes":"Iframe with JS URI","expected_block":true},
  {"id":"xss-ev-032","payload":"<iframe srcdoc='<script>alert(1)</script>'>","category":"xss","method":"GET","severity_hint":"critical","tags":["iframe","srcdoc"],"notes":"Iframe srcdoc injection","expected_block":true},
  {"id":"xss-ev-033","payload":"<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>\">","category":"xss","method":"GET","severity_hint":"critical","tags":["math","mtext","mutation-xss"],"notes":"MathML mutation XSS","expected_block":true},
  {"id":"xss-ev-034","payload":"<svg><animate onbegin=alert(1) attributeName=x dur=1s>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","animate","onbegin"],"notes":"SVG animate onbegin","expected_block":true},
  {"id":"xss-ev-035","payload":"<svg><set onbegin=alert(1) attributeName=x to=1>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","set","onbegin"],"notes":"SVG set element onbegin","expected_block":true},
  {"id":"xss-ev-036","payload":"<svg><a><rect width=100% height=100%></rect><animate attributeName=href values=javascript:alert(1) /></a>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","animate","href"],"notes":"SVG animated href","expected_block":true},
  {"id":"xss-ev-037","payload":"<svg><use href=data:image/svg+xml;base64,PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI+PGVtYmVkIHNyYz0iamF2YXNjcmlwdDphbGVydCgxKSIvPjwvc3ZnPg==#x>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","use","data-uri","base64"],"notes":"SVG use with base64 data URI","expected_block":true},
  {"id":"xss-ev-038","payload":"<script>eval(atob('YWxlcnQoMSk='))</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","base64","eval"],"notes":"Base64 decoded eval","expected_block":true},
  {"id":"xss-ev-039","payload":"<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","charcode","eval"],"notes":"CharCode eval bypass","expected_block":true},
  {"id":"xss-ev-040","payload":"<script>[].constructor.constructor('alert(1)')()</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","constructor","evasion"],"notes":"Constructor chain execution","expected_block":true},
  {"id":"xss-ev-041","payload":"<script>window['al'+'ert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","string-concat","evasion"],"notes":"String concat function name","expected_block":true},
  {"id":"xss-ev-042","payload":"<script>this['alert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","bracket-notation"],"notes":"Bracket notation access","expected_block":true},
  {"id":"xss-ev-043","payload":"<script>self['alert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","self-reference"],"notes":"self object reference","expected_block":true},
  {"id":"xss-ev-044","payload":"<script>top['alert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","top-reference"],"notes":"top object reference","expected_block":true},
  {"id":"xss-ev-045","payload":"<script>parent['alert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","parent-reference"],"notes":"parent object reference","expected_block":true},
  {"id":"xss-ev-046","payload":"<script>frames['alert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","frames-reference"],"notes":"frames object reference","expected_block":true},
  {"id":"xss-ev-047","payload":"<script>globalThis['alert'](1)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","globalThis"],"notes":"globalThis access","expected_block":true},
  {"id":"xss-ev-048","payload":"<script>Function('alert(1)')()</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","Function-constructor"],"notes":"Function constructor","expected_block":true},
  {"id":"xss-ev-049","payload":"<script>new Function`alert\\u00601`()</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","tagged-template"],"notes":"Tagged template with Function","expected_block":true},
  {"id":"xss-ev-050","payload":"<script>setTimeout('alert(1)',0)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","setTimeout"],"notes":"setTimeout string eval","expected_block":true},
  {"id":"xss-ev-051","payload":"<script>setInterval('alert(1)',1000)</script>","category":"xss","method":"GET","severity_hint":"critical","tags":["script","setInterval"],"notes":"setInterval string eval","expected_block":true},
  {"id":"xss-ev-052","payload":"<svg onload=alert(/xss/)>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","regex-literal"],"notes":"RegExp literal alert arg","expected_block":true},
  {"id":"xss-ev-053","payload":"<svg onload=alert(document.domain)>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","document.domain"],"notes":"Domain exfiltration","expected_block":true},
  {"id":"xss-ev-054","payload":"<svg onload=alert(document.cookie)>","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","cookie-theft"],"notes":"Cookie exfiltration","expected_block":true},
  {"id":"xss-ev-055","payload":"<img src=x onerror=\"javascript:alert(1)\">","category":"xss","method":"GET","severity_hint":"critical","tags":["img","javascript-prefix"],"notes":"javascript: prefix in event","expected_block":true},
  {"id":"xss-ev-056","payload":"<img src=x onerror=eval('\\x61\\x6c\\x65\\x72\\x74\\x28\\x31\\x29')>","category":"xss","method":"GET","severity_hint":"critical","tags":["img","hex-escape","eval"],"notes":"Hex escaped eval payload","expected_block":true},
  {"id":"xss-ev-057","payload":"<img src=x onerror=eval('\\141\\154\\145\\162\\164\\050\\061\\051')>","category":"xss","method":"GET","severity_hint":"critical","tags":["img","octal-escape","eval"],"notes":"Octal escaped eval payload","expected_block":true},
  {"id":"xss-ev-058","payload":"<img src=x onerror=eval('\\u0061\\u006c\\u0065\\u0072\\u0074\\u0028\\u0031\\u0029')>","category":"xss","method":"GET","severity_hint":"critical","tags":["img","unicode-escape","eval"],"notes":"Unicode escaped eval payload","expected_block":true},
  {"id":"xss-ev-059","payload":"<!--><svg/onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["comment-bypass","svg"],"notes":"HTML comment bypass","expected_block":true},
  {"id":"xss-ev-060","payload":"\"><svg/onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["attribute-break","svg"],"notes":"Double quote attribute break","expected_block":true},
  {"id":"xss-ev-061","payload":"'><svg/onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["attribute-break","svg"],"notes":"Single quote attribute break","expected_block":true},
  {"id":"xss-ev-062","payload":"><svg/onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["tag-break","svg"],"notes":"Tag break with SVG","expected_block":true},
  {"id":"xss-ev-063","payload":"</script><svg/onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["script-break","svg"],"notes":"Script tag break","expected_block":true},
  {"id":"xss-ev-064","payload":"</title><svg/onload=alert(1)>","category":"xss","method":"GET","severity_hint":"critical","tags":["title-break","svg"],"notes":"Title tag break","expected_block":true},
  {"id":"xss-ev-065","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["img","attribute-chain"],"notes":"Cross-attribute payload","expected_block":true}, {"id":"xss-ev-072","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["svg","script","html-entity"],"notes":"HTML entities in SVG script","expected_block":true}, {"id":"xss-ev-074","payload":"

","category":"xss","method":"GET","severity_hint":"critical","tags":["math","img","mathml"],"notes":"MathML context switch","expected_block":true}, {"id":"xss-ev-075","payload":"<img src=x onerror=alert(1)//>","category":"xss","method":"GET","severity_hint":"critical","tags":["xmp","legacy"],"notes":"Legacy XMP element","expected_block":true}, {"id":"xss-ev-076","payload":"","category":"xss","method":"GET","severity_hint":"critical","tags":["form","formaction"],"notes":"formaction javascript: URI","expected_block":true}, {"id":"xss-ev-077","payload":"","category":"xss","method":"GET","severity_hint":"critical","tags":["isindex","legacy"],"notes":"Legacy isindex element","expected_block":true}, {"id":"xss-ev-078","payload":"click","category":"xss","method":"GET","severity_hint":"high","tags":["custom-element","onclick"],"notes":"Custom element with event","expected_block":true}, {"id":"xss-ev-080","payload":"","category":"xss","method":"GET","severity_hint":"critical","tags":["style","import","css"],"notes":"CSS import injection (legacy)","expected_block":true} ]