New answers tagged


As far as you're letting on, this isn't an "unrestricted file upload" vulnerability. "Unrestricted file upload" means uploading the file to their domain/server, not yours. SVG images sourced this way (via images) don't normally execute the javascript they contain. If you manage to upload an .svg file to their domain, and it's accessible ...

Top 50 recent answers are included