firefox-rce-nssmil

Firefox RCE CVE-2016-9079 – Educational JavaScript Port Educational implementation of the public exploit for CVE-2016-9079, adapted from the original Exploit-DB/Metasploit module for standalone use. Disclaimer This repository is provided strictly for educational and research purposes. It contains...

CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

CVE-2026-110505

The Enable SVG, WebP, and ICO Upload WordPress plugin versions prior to 1.1.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to prevent animation elements within uploaded SVG files from changing a link's target to a javascript: URI, effectively bypassing the plug...

Linux Distros Unpatched Vulnerability : CVE-2026-116802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

SUSE CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

EUVD-2026-110510

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

Cure53 DOMPurify cross-site scripting vulnerability

Versions of Cure53 DOMPurify prior to 3.4.17 contain a cross-site scripting vulnerability. This flaw arises because when PARSERMEDIATYPE is set to application/xhtml+xml, transformCaseFunc fails to convert attribute names to lowercase. Attackers can exploit this by using SVG files containing anima...

CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116802

Versions of DOMPurify prior to 3.4.17 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is that transformCaseFunc fails to lowercase attribute names, allowing attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is set to application/xhtml+xml. E...

CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

PT-2026-125508

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER MEDIA TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

SUSE CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

npm: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

npm: DOMPurify: SMIL attributeName=href guard is skipped when PARSERMEDIATYPE is application/xhtml+xml vulnerability discovered by ? in WordPress npm dompurify versions = 3.4.16...

GHSA-C6GR-QVV4-5V3F DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...

DEBIAN-CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...