CVE-2026-10702

CVE-2026-10702 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3. Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as...

CLEANSTART-2024-BO49867 Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash

CVE-2021-23960 affects multiple packages. Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. See references for individual vulnerability details...

CLEANSTART-2024-CP09574 Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash

CVE-2021-23954 affects multiple packages. Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. See references for individual vulnerability details...

CVE-2023-29489

CVE-2023-29489 The security vulnerability is recorded in the Common Vulnerabilities and Exposures CVE system. Specifically, this vulnerability is related to cPanel, a popular hosting management software. This flaw allows for cross-site scripting XSS attacks through specially crafted requests."...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "email" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor ca...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 Summary A vulnerability is discovered in the SCM Manager 1.2 = 1.60 version that allows an attackers previously authenticated with write permissions execute javascript code in specific fields. This Proof of Concept is maded in a local environment...

Apache-couchdb-CVE-2017-12635

CouchDB Vertical Privilege Escalation Vulnerability CVE-2017-12635 Apache CouchDB is an open-source database that focuses on ease of use and being a "fully web-embracing database." It is a NoSQL database that uses JSON as the storage format, JavaScript as the query language, and MapReduce and HTT...

unfurl

unfurl Pull out bits of URLs provided on stdin Install If you have Go installed and configured: ▶ go install github.com/tomnomnom/unfurl@latest Otherwise download the latest binary for your platform, extract it and move it to somewhere in your $PATH e.g. /usr/bin/: ▶ wget...

audit-xss-cve-2020-7934

CVE 2020-7934 How to run CVE Requirements 1. docker Remarks it's possible put the script attack online given the js code http://yourjavascript.com/ Our Js script online for the attack html Commands for configuration 1. go to root folder of this project 2. run "sudo docker-compose up --build" 3. n...

CVE-2024-33299

CVE-2024-33299 Stored Cross Site Scripting vulnerability in Microweber = 2.0.9 Summary : A Stored Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users...

CVE-2020-6418-PoC

CVE20206418PoC for 供養 Sandbox escape exploit not included. PoC Environment OS: ubuntu 18.04 LTS V8: Release build8.0.426.23 References https://github.com/saelo/jscpwn https://bugs.chromium.org/p/chromium/issues/detail?id=1053604...

com.heytap.browser

Vulnerability Report Overview: A vulnerability has been discovered in the com.heytap.browser application on the Android platform. The vulnerability allows an attacker to execute arbitrary JavsScript code within the context of the application without any permissions. Application Details: Vendor: -...

WebFEET

Web Filter External Enumeration Tool WebFEET WebFEET Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ben Williams https://github.com/nccgroup/webfeet Released under AGPL see LICENSE for more information WebFEET is a web application for the drive-by enumeration of...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Attack Vectors: Scripting A vulnerability in the sanitization of t...

CVE-2024-8381

CVE-2024-8381 A SpiderMonkey Interpreter Type Confusion Bug. This repository contains analyses in markdown and slide forms, including root cause, PoC, and exploit. Unfortunately, due to nature of this bug, exploit is only applicable when ASLR is disabled. Slides: Slides.pdf Analysis: Analysis.md...

CVE-2025-29018

CVE-2025-29018 - Internet Banking System 2.0.0 Stored XSS in pagesaddacctype.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 due to unsanitized input in the name parameter in pagesaddacctype.php. Attackers can store malicious...

CVE-2024-4367-Analysis

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js Overview CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting XSS attacks. This affects Firefox Example: python3 poc.py "alert1" Demo...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...