Roundcube round two: three more sanitizer bypasses

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Three more bypasses in Roundcube's HTML sanitizer: SMIL animation attributes load remote resources, unquoted body backgrounds enable CSS injection, and position:fixed !important enables phishing overlays.

Read on nullcathedral.com ↗