HTML-Encoded Attribute Escape
1
1
1Checks for any escaping from the img tag attribute from encoded input without using double quotes
Created byIDKdir
Created Jul 13, 2024
Updated May 27, 2025
Detecting browser...
CategoryDOM Behavior
VisibilityPublic
TypeXSS
CharsetUTF-8
Template used:
<img src="/image.png" tag="html($[chr])><iframe><!--">Code used after fuzz:
if (document.querySelector('iframe')) {0x0D
log($[chr]);0x0D
}Fuzz results
Chrome 148.0.0.0 desktop Windows NT 10.0
Updated15 Mar 2026
Found 1 result
Loading...
Firefox 149.0 desktop macOS 10.15
Updated3 Apr 2026
Found 1 result
Loading...
Microsoft Edge 146.0.0.0 desktop Windows NT 10.0
Updated6 Apr 2026
Found 1 result
Loading...