Update Chrome now to protect against an actively exploited vulnerability

Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited. The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and 153.0.8010.36 for Linux. How to update Chrome If you don’t want to wai...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter es una herramienta avanzada de Python diseñada para investigadores de seguridad, que automatiza la detección de secretos incrustados en JavaScript del lado del cliente. A diferencia de los escáneres simples, V2 incluye un rastreador dinámico que analiza el...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 SVG XSS Reflejado Cross-Site Scripting XSS Reflejado mediante Renderizado SVG en FuguHub https://vulners.com/cve/CVE-2025-65790 Este repositorio documenta una vulnerabilidad de Cross-Site Scripting XSS Reflejado en FuguHub 8.1 , donde los archivos SVG que contienen...

cve-lite-on-pi

cve-lite-on-pi Un breve informe sobre la ejecución de CVE Lite CLI contra el monorepositorio pi , y lo que encontró. Antecedentes Este experimento fue motivado por el artículo "OWASP CVE Lite CLI – Nueva herramienta para escanear vulnerabilidades en tus proyectos" CyberSecurityNews. ¿Qué es CVE...

CVE-2024-28397-Js2Py-RCE-Exploit

💡 Análisis en profundidad: Haz clic aquí para leer el informe técnico completo PDF. CVE-2024-28397: Generador de payloads para evasión de sandbox en Js2Py Un generador de payloads profesional para CVE-2024-28397. Esta herramienta genera código JavaScript malicioso diseñado para escapar del sandbo...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

EUVD-2026-75256

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

Adobe ColdFusion - Cross-Site Scripting

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting

WordPress Elementor Website Builder plugin before 3.1.4 contains a DOM cross-site scripting vulnerability. It does not sanitize or escape user input appended to the DOM via a malicious hash. id: CVE-2021-24891 info: name: WordPress Elementor Website Builder 3.1.4 - Cross-Site Scripting author:...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

rConfig 3.9.4 - Cross-Site Scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php id: CVE-2020-12259 info: name: rConfig 3.9.4 - Cross-Site Scripting...

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter. id: CVE-2018-20824 info: name: Atlassian Jira WallboardServlet 7.13.1 - Cross-Site Scripting author:...

Milesight Routers - Information Disclosure

A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

Adobe Coldfusion - Cross-Site Scripting

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within th...

ZeroRAT

ZeroRAT Introducción Herramienta de control remoto RAT para Windows. El cliente solo necesita ejecutar una única instrucción; utiliza programas nativos de Windows para ejecutarse, no escribe archivos en el disco y cuenta con características naturales de evasión de antivirus. Deja de funcionar tra...

CVE-2026-5615

CVE-2026-5615 — VvvebJs Cross-Site Scripting Almacenado RXSS Descripción general Este repositorio contiene un script de prueba de concepto PoC en Python que demuestra una vulnerabilidad de Cross-Site Scripting Almacenado RXSS que afecta a VvvebJs ⚠️ Este proyecto está destinado estrictamente a...