Skip to content
SVG animate XSS vector
portswigger.net | research | #browser-security | #web-security | #xss | #payload-obfuscation | #waf-bypass | #svg
Summary
Gareth Heyes finds an SVG animate XSS vector that hides a javascript: URL inside the values attribute, using keyTimes and repeatCount to slip past WAFs scanning for the JavaScript protocol.
- Published
- Collected