While doing a little investigating I found a vector using XML namespace which includes a .htc file that includes JS. It’s a nice little vector since it doesn’t use the javascript directive or script tags.

This entry was posted on Thursday, January 1st, 1970 at 12:00 am and is filed under XSS, Webappsec. You can leave a response as well.