Writeups
Stored XSS via SVG Upload
While testing file upload forms across a platform, I uploaded an SVG with a JavaScript payload — it got served from the CDN without sanitization, triggering stored XSS.
While testing file upload forms across a platform, I uploaded an SVG with a JavaScript payload — it got served from the CDN without sanitization, triggering stored XSS.