Malicious code in pystr-codec (PyPI)

Source: kam193 9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1 Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting...

CSRF-exploit-generator

CSRF-exploit-generator The CSRF Exploit Generator allows users to generate a CSRF exploit form with configurable parameters. CSRF-exploit-generator Features Input Target URL : Specifies the URL to be exploited. Input POST Parameters : Allows adding POST parameters to be sent via the CSRF request...

CVE-2021-30146

CVE-2021-30146 Seafile 7.0.5 Persistent XSS Suggested description: Application Server Version: 7.0.5 Seafile is vulnerable to Persistent XSS via share library functionality. Additional Information: Seafile is an open source, self-hosted file sync and share solution with high performance and...

JSAnalyzer

JS Analyzer - Burp Suite Extension by Jensec https://x.com/jensec A powerful Burp Suite extension for JavaScript static analysis. Extracts API endpoints, URLs, secrets, and email addresses from JavaScript files with intelligent noise filtering. The goal is reduce noise as much as possible to ensu...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Stored Cross-Site Scripting XSS in Perfex CRM Chatbot ⚠️ Security Advisory A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature 📋 Overview A stored cross-site scripting XSS vulnerability in the chatbot component of Perfex CRM, prior to...

study-turbolinks-link

JavaScript Usage https://github.com/turbolinks/turbolinksapi-reference Turbolinks.visit'/home/two' // default is advance. Turbolinks.visit'/home/two', action: 'advance' Turbolinks.visit'/home/two', action: 'replace'...

CVE-2024-41662

CVE-2024-41662 Markdown XSS leads to RCE in VNote version NOTE: The application properly validates some JavaScript payloads by performing output encoding in the app. However, it fails to validate in certain cases. 5. Further an attacker can achieve Remote Code execution using the following payloa...

CVE-2024-28397-command-execution-poc

CVE-2024-28397-command-execution-poc This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbitrary command execution. JSON-Parsers & RCE Exploit PoC...

cve-2025-0133

CVE-2025-0133 Reflected XSS Detection Tool Author : Derek Odiorne Date : 2025-05-23 Severity : Medium Tested Against : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 Summary This script performs safe, authorized testing for the vulnerability CVE-2025-0133 , a reflected Cross-Site Scripting XSS...

Published-CVE

Published-CVE This repository contains descriptions and exploits for two security vulnerabilities: 1. CVE-2023-33580: Stored Cross-Site Scripting XSS in the Student Study Center Management System V1.0, allowing attackers to execute arbitrary JavaScript code. 2. CVE-2023-33584: SQL Injection SQLI ...

Label Studio - Cross-Site Scripting

Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

Grafana <= 6.7.1 - Cross-Site Scripting

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...

NeDi 1.9C - Cross-Site Scripting

NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2710 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting author:...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting XSS via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2024-9007 info: name: 123Solar 1.8.4.5 - Cross-Site Scripting author: ritikchaddha...

WordPress TranslatePress < 3.2.6 - Cross-Site Scripting

TranslatePress plugin 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges. id: CVE-2026-17505 info: name: WordPres...