Top 10 winner

Fuzzing for XSS via nested parsers condition

Igor Sak-Sakovskiy and @Psych0tr1a · PT SWARM

When two markup parsers run in sequence over the same message, the first parser output becomes the second parser input, letting injected markup escape an attribute value into attribute-name position. Fuzz lists that plant convertible markup inside other markup found this cross-site scripting in vBulletin, MyBB, PMWiki, Rocket.Chat, XMB, SMF and PunBB.

Record

Researcher

Igor Sak-Sakovskiy and @Psych0tr1a

Published by

PT SWARM

Topic

XSS

In the archive

• Ranked #10 in the 2021 Top 10 Web Hacking Techniques

Tags

• xss
• sanitizer-bypass
• parser-differential
• filter-bypass
• fuzzing
• injection
• php
• cve
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Igor Sak-Sakovskiy and @Psych0tr1a, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.