CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVG 注入 GHSA-vcvr-r3jv-pc5j 用于在隔离的、仅限回环的实验室环境中复现和验证 CVE-2026-94545 的安全研究材料， 即 Next.js ImageResponse SVG 序列化注入（上游：Satori GHSA-wx4j-mvgx-mqwp ）。 受影响： Next.js =16.2.0 攻击者 控制嵌入的 SVG 文档；根据公告，RCE 取决于 下游 SVG 解析器 上游： vercel/satori GHSA-wx4j-mvgx-mqwp...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS 漏洞利用 📋 漏洞利用信息 漏洞利用标题： Roundcube Webmail 通过 SVG href 实现 DOM XSS（CVE-2026-25916） 作者： Mohammed Idrees Banyamer 联系方式： GitHub @mbanyamer | Instagram @banyamersecurity 国家： 约旦 日期： 2026年2月9日 CVE： CVE-2026-25916 类型： 基于 DOM 的跨站脚本攻击（XSS） 平台： Web 应用程序 测试环境： Roundcube...

CVE-2026-107380

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-107379

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107303

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return...

EUVD-2026-95137

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-107380

The savg-sanitizer PHP SVG/XML sanitizer is vulnerable to Stored XSS in versions prior to 1.0.0 . The issue stems from a discrepancy between isHrefSafeValue(), which validates href attributes after XML DTD entity expansion, and saveXML(), which serializes the original entity reference after remov...

CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

EUVD-2026-95136

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379

The PHP SVG/XML sanitizer svg-sanitizer is vulnerable in versions prior to 1.0.0 due to a flaw in the src/Sanitizer.php file. Specifically, a crafted SVG DTD with a #FIXED attribute default can cause the cleanAttributesOnWhitelist() function to perform a double DOMElement::removeAttribute() call ...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378

The CairoSVG library, an SVG converter based on Cairo, is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.9.1 . The root cause is an inefficient algorithmic complexity (CWE-407) within cairosvg/path.py, where the path tokenizer repeatedly slices and rescans path data. Additi...

CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-22610

Angular SVG 漏洞扫描器 CVE-2026-22610 用途： 扫描 Angular 项目，查找 SVG 元素中潜在的 XSS 漏洞、不安全的 Angular 绑定（attr.href、attr.xlink:href、 ）以及 bypassSecurityTrustResourceUrl 的使用。 用法 在项目根目录运行脚本： 扫描当前文件夹 node scan-angular-svg-vuln-final.js 扫描指定文件夹 node scan-angular-svg-vuln-final.js /project1/src 输出： 列出存在漏洞的文件及其行号和类型...

CVE-2023-4357

【CVE-2023-4357】Chrome-XXE 任意文件读取漏洞复现 REPRODUCTION CASE Use files shown above or browse to http://188.68.220.248/js.svg...

CVE-2025-60880

CVE-2025-60880：Bagisto 管理面板中的存储型跨站脚本（XSS）漏洞 Bagisto 2.3.6 管理面板的产品创建路径中存在一个已认证的存储型 XSS 漏洞，允许攻击者上传包含恶意 JavaScript 代码的特制 SVG 文件。该漏洞可被已认证的管理员用户利用，在浏览器中执行任意 JavaScript，可能导致会话劫持、数据窃取或未授权操作。 漏洞概述 CVE ID ：CVE-2025-60880 类型 ：跨站脚本（XSS） CVSS 评分 ：6.9（中危） CVSS 向量 ：CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N...

CVE-2024-50803-Redaxo

CVE-2024-50804 Redaxo 的 mediapool 功能中的存储型 XSS 在 Redaxo 版本 5.18.0 中发现了一个存储型跨站脚本（XSS）漏洞，允许具有足够权限的攻击者通过 mediapool 功能上传恶意 SVG 文件。 发布了一篇分析文章 ：https://medium.com/@praison66/5d15a3cd054d 由 Praison 于 2024 年 9 月发现。 参考 ： https://vulners.com/cve/CVE-2024-50804...