CVE-2025-59528-PoC

CVE-2025-59528 PoC Proof of Concept for researching CVE-2025-59528 in an isolated laboratory environment. !WARNING DISCLAIMER This project is intended strictly for educational purposes, security research, and testing systems that you own or have explicit authorization to test. Do not use this PoC...

CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 Reflected XSS via DICOM Image Upload Handler If you want to chain this XSS with RCE you can read: https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce Description OpenClinic GA = v5.351.19 12/05/2026 contains a reflected cross-site...

msgpack-CVE-2021-23410-test

Test for https://snyk.io/vuln/SNYK-JS-MSGPACK-1296122 This looks like not vulerbility. var assert = require'assert'; var msgpack = require'msgpack'; function sleepms return new Promiseresolve = setTimeoutresolve, ms; ; async function init var normal = "a": 1, "b": 2, "c": 1, 2, 3 ; var malicious ...

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

The tracing method of this honeypot targets red team members using mobile hotspots. The honeypot directly obtains the attacker's phone number for tracing. It catches them every time. Red team members, be careful. First, when you open the website, it monitors whether the F12 console is opened. If...

CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...

CVE-2025-55182_liyon

CVE-2025-55182 - React Server Components RCE ⚠️ Legal Notice : This tool is intended solely for security research, authorized penetration testing, and educational purposes. Using this tool against any system without explicit permission is illegal and unethical. 📋 Overview CVE-2025-55182 is a...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. https://vulners.com/cve/CVE-2021-37833...

CVE-2026-40579

References https://github.com/steveukx/git-js/security/advisories/GHSA-mr9g-9pv2-x45j https://vulners.com/cve/CVE-2026-40579...

BadKernel

BadKernel full exploit for CVE-2016-6754BadKernel slide for syscan2016 shanghai "BadKernel --- exploit V8 with a typo"...

PT-2026-135046

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.19.0 Apache Wicket versions 9.0.0 through 9.24.0 Apache Wicket versions 10.0.0 through 10.11.0 Description Improper neutralization of input during web page generation occurs when the...

npm-demo

Browser Demo NPM/JavaScript For instructions on how to run and use this demo, see the Hands-On Trial Guide...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js This project demonstrates and analyzes CVE-2024-4367 , a high-severity vulnerability in Mozilla’s PDF.js library that allows arbitrary JavaScript execution through improper type checking in font handling code. Our research shows how a...

CVE-2023-34599

CVE-2023-34599 Multiple Cross-Site Scripting XSS vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. Proof of Concept Parameter allUsers http://gibbon.local/index.php?q=/modules/Timetable...

CVE-2017-12635

CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...

windbg_js_scripts

WinDbg JavaScript Scripts Install as a WinDbg gallery Clone the repository git clone https://github.com/hugsy/windbgjsscripts In windbgjsscripts\config.xml, edit the lines Setting Name="LocalCacheRootFolder" to reflect the local path of the repository. In WinDbg, load the config.xml file and save...

JShunter

JSHunter Professional JavaScript Security Analysis Tool Complete endpoint discovery, sensitive data detection, and advanced code analysis for security professionals About JSHunter is a comprehensive command-line tool for JavaScript security analysis and endpoint discovery. Built for security...

CVE-2025-63498

Stored XSS in cookie Alinto/SOGo Researchers: Daniil Khomichenok, Alexander Klimenko Affected Versions var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Code of login remember set-cookie which accepts XSS injections as a paramteter value: if...

CVE-2024-52794-Discourse-Stored-XSS

CVE-2024-52794 – Stored Cross-Site Scripting XSS in Discourse Summary I discovered a stored cross-site scripting XSS vulnerability in Discourse, an open-source forum platform. The vulnerability allows an attacker to execute arbitrary JavaScript in the victim’s browser by injecting a malicious...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...

CVE-2019-0678

Vulnerability Microsoft Edge Elevation of Privilege Vulnerability Vulnerability Description This vulnerability allows an attacker to execute javascript code on every host without the permission, also an attacker can steal local system files, and this also results in changing internal developer...