UBUNTU-CVE-2026-53939

OpenIDC/cjose is a C library implementing the Javascript Object Signin...

Linux Distros Unpatched Vulnerability : CVE-2026-88859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. Wh...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier 🔥 ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for...

CVE-2026-29598

CVE-2026-29598: Cross-Site Scripting XSS Almacenado en cm3 Acora CMS versión 10.7.1. DDSN Interactive cm3 Acora CMS versión 10.7.1 contiene una vulnerabilidad de Cross-Site Scripting XSS Almacenado en la funcionalidad de gestión de usuarios. Un administrador con la capacidad de añadir o editar...

ditto

ditto Ofuscador de Powershell Ditto es un ofuscador de Powershell y JavaScript basado en tree-sitter-powershell y tree-sitter-javascript. Uso desde la Línea de Comandos Estructura Básica del Comando ditto-cli opciones Argumentos y Opciones de la CLI Opción Corta| Opción Larga| Descripción...

CVE-2024-42009

CVE-2024-42009 – XSS Almacenado en Roundcube PoC Docker 📌 Descripción General Este repositorio demuestra una Prueba de Concepto PoC funcional para CVE-2024-42009 , una vulnerabilidad de Cross-Site Scripting XSS almacenado en Roundcube Webmail. La vulnerabilidad es causada por una sanitización HTM...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2025-56800

CVE-2025-56800 Vulnerabilidad de omisión de autenticación local en la aplicación de escritorio de Reolink 1. Resumen Nombre : Aplicación de escritorio de Reolink Versión : 8.18.12 Vendedor : Reolink CWE : CWE-290: Omisión de autenticación mediante suplantación CVSS : 5.1 MEDIO Cadena de vector :...

CVE-2025-55182

CVE-2025-55182 针对 React JavaScript 框架中 RCE 漏洞的基于主机的检测规则。...

CVE-2014-9219

CVE-2014-9219 CVE-2014-9219 XSS POC 关于 该漏洞由 phpMyAdmin 4.2.x 版本（4.2.13.1 之前）中 url.php 的重定向功能在处理 url 参数时的输入验证错误引起。远程攻击者可诱骗受害者访问特制链接，并在受害者的浏览器中，在易受攻击网站的安全上下文中执行任意 HTML 和脚本代码。 受影响版本 phpMyAdmin：4.2.0 - 4.2.13 问题 存在漏洞的代码使用 htmlspecialchars 来清除 URL 参数，然后将其插入 JavaScript 字符串上下文中： root@kitploit:...

DEBIAN-CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2025-56243

CVE-2025-56243 - XSS Reflejado en PuneethReddyHC / Event Management System v1.0 Título: Cross-Site Scripting XSS Reflejado a través del parámetro eventid en register.php Vendedor / Repositorio: PuneethReddyHC / event-management Versión afectada: 1.0 rama/etiqueta master en el momento de las prueb...

EUVD-2026-75108

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

Expression-Sandbox-Escape-Simulation-Lab

🧪 Expression Sandbox Escape – Simulation Lab Un entorno experimental mínimo para demostrar la evasión de sandbox de expresiones JavaScript y la evolución de parches. A través de múltiples versiones del sandbox, se implementa la transición de: Totalmente evadible → parchear this → parchear...

CVE-2025-67730

CVE-2025-67730 – 存储型跨站脚本 XSS 概述 CVE ID: CVE-2025-67730 漏洞类型: 存储型跨站脚本 XSS 严重性: 中高 取决于上下文 此漏洞允许经过身份验证的用户将恶意HTML和JavaScript注入到Job 、Course 和Batch 表单的描述字段 中。注入的有效载荷会在随后查看受影响的Job、Course或Batch的任何用户的浏览器中自动执行。 受影响的组件 Job 描述字段 Course 描述字段 Batch 描述字段 影响 在受害者浏览器中执行任意JavaScript 会话劫持 凭据窃取 账户接管（取决于权限级别） DOM操纵和钓...

CVE-2024-4367-hands-on-01

!IMPORTANT Este repositorio es para aprender sobre vulnerabilidades. Realice este taller únicamente en un ordenador adecuado que usted gestione. No realice nunca actividades ilegales. Además, el autor no se hace responsable de ningún daño o responsabilidad derivados de este repositorio...

CVE-2026-87812

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87814

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...