Our favourite community contributions to the XSS cheat sheet
Summary: PortSwigger Research highlighted seven community submissions to its XSS cheat sheet, published October 3, 2022 and updated October 20, 2022, ranking them from missing events submitted by @hahwul to a top entry from @ladecruze that uses the location object, base64 decoding, and tagged template strings. Other entries included a Vue vector from @p4fg using the v-if attribute, an AngularJS vector from @NotSoSecure for character-restricted injections, and an onbeforeinput event from @laytonctf that the post says bypasses denylists of known bad events.
Key Takeaway: The top-ranked payload is built to slip past a WAF that does not detect backticks, and the post notes that a grave entity may defeat a WAF that does - a reminder that WAF signature lists are a moving target maintained by the same community publishing these vectors.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026