CVE-2026-125816

The MapSVG WordPress plugin (versions

CVE-2026-128028

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in MageCatalogModelProductOptionTypeFile, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list...

CVE-2026-126306 EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a...

CVE-2026-126306

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw allows low-privileged users to upload crafted SVG images designed to submit authenticated POST requests to arbitrary backend endpoints. An attacker can trick an admi...

EUVD-2026-125214

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a...

EUVD-2026-125014

OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doclib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files...

CVE-2026-127084

The Teable application, in versions prior to 2026-10-12T12-45-53Z.3331 , is vulnerable to Stored Cross-Site Scripting (XSS) via attachment uploads. The root cause allows authenticated users to upload SVG or HTML attachments using an attacker-chosen content type. Attackers can then direct victims ...

EUVD-2026-125098

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty...

CVE-2026-127084 Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty...

CVE-2026-128028

The OpenMage magento-lts software versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists in Mage_Catalog_Model_Product_Option_Type_File , which allows unauthenticated attackers to upload SVG, XHTML, or XML ...

EUVD-2026-125074

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in MageCatalogModelProductOptionTypeFile, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list...

svg-sanitizer

SVG Sanitizer SVG Sanitizer is a Java library designed to clean SVG files by removing potentially dangerous JavaScript, blocking external resource loading, and preventing XSS Cross-Site Scripting vulnerabilities. It is useful for ensuring that SVG files are safe to use in a variety of application...

CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection GHSA-vcvr-r3jv-pc5j Security-research material for reproducing and validating CVE-2026-94545 , the Next.js ImageResponse SVG-serialization injection upstream: Satori GHSA-wx4j-mvgx-mqwp, in an isolated, loopback-only lab. Affected:...

Z-Downloads < 1.11.7 - Cross-Site Scripting

The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. id: CVE-2024-8673 info: name: Z-Downloads 1.11.7 - Cross-Site Scripting author: Splint3r7 severity: low description: | The plugin does not properly validate uploaded files...

SiYuan <= v3.5.9 - Cross Site Scripting

SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon. id: CVE-2026-31809 info: name: SiYu...

SiYuan <= v3.5.9 - SVG Animate Element XSS

SiYuan = v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts. id: CVE-2026-31807 info: name: SiYuan = v3.5.9 - SVG Animate...

Imgproxy < 3.14.0 - Cross-site Scripting (XSS)

Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. id: CVE-2023-1496 info: name: Imgproxy 3.14.0 - Cross-site Scripting XSS author: pdteam severity: medium description: Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to...

GutenKit Blocks Addon < 2.5.0 - Stored Cross-Site Scripting

GutenKit Blocks Addon before 2.5.0 lets an authenticated Author upload an unsanitized SVG through the WordPress REST media endpoint; JavaScript in the SVG can execute when a user opens its URL. id: CVE-2026-19697 info: name: GutenKit Blocks Addon 2.5.0 - Stored Cross-Site Scripting author:...

SiYuan Note - Cross-Site Scripting

Unauthenticated reflected cross-site scripting XSS vulnerability in all versions of SiYuan Note containing /api/icon/getDynamicIcon with unsafe type=8 rendering logic. Attacker-controlled content is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary...

svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...