I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results