One XSS cheatsheet to rule them all
Summary: PortSwigger Research published an XSS cheatsheet cataloging vectors for bypassing HTML filters and WAFs, each with a hosted proof of concept and the browsers it executes on. Researcher Gareth Heyes describes novel techniques found through automated fuzzing and manual probing, including CSS transition events triggered via the :target selector and URL hash, focus events fired on any element using tabindex, and IE-specific onactivate events.
Bottom line: The cheatsheet documents that a URL hash plus a tabindex attribute can fire focus events on nearly any element, including custom tags, which means filter rules built around blocking autofocus and known event handlers will miss these vectors.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026