CVE-2026-27597

CVE-2026-27597 - Ejecución Remota de Código por versión Uso Rápido root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Notas de Explotación Severidad: CRÍTICA CVSS: 10.0 Impacto: Confidencialidad, Integridad, Disponibilidad Publicado: 2026-02-25 Resumen...

CVE-2026-22686

Desafío CTF de Escape de Sandbox de Máquina Virtual Enclave Desafío: "Rompiendo los Muros" Dificultad: Difícil Categoría: Revisión de Código Fuente / Escape de Sandbox Puntos: 500 Escenario Has descubierto un misterioso entorno de ejecución de JavaScript en sandbox...

CVE-2019-5784-PoC

CVE-2019-5784-PoC CVE-2019-5784 的概念验证 文件 main.js: 实际漏洞 html.html: 非必需。...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — 通过磁贴HTML字段存储型XSS（PoC） 此仓库记录了一个概念验证（PoC） ，针对影响URVE Smart Office 的iOS移动应用 的存储型跨站脚本（XSS）漏洞 。 由于输入验证实现不足，攻击者控制的JavaScript可以被注入到磁贴的HTML字段 中。有效载荷被存储，并在受影响内容传递至移动客户端并在iOS设备上渲染时执行。 ⚠️ 法律免责声明 未经双方事先同意，使用此PoC攻击目标是违法的。 最终用户有责任遵守所有适用的地方、州和联邦法律。 作者和贡献者对任何滥用或造成的损害不承担责任。 CVE 详情 CVE ID:...

CVE-2025-7062

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

Remediate-AdobeAcrobat-CVE-2026-34621

Intune Proactive Remediation – Aplicación de versión de Adobe Acrobat/Reader CVE-2026-34621 Este repositorio contiene scripts de Proactive Remediation de Microsoft Intune para reducir la exposición a vulnerabilidades de Adobe Acrobat/Reader mediante: 1. Aplicar una versión mínima parcheada detect...

MAL-2026-16077 Malicious code in chai-as-sleek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while...

CVE-2021-40374

CVE-2021-40374 - OpenEyes 3.5.1 中的存储型跨站脚本（Stored Cross-site Scripting） 描述 在由 Apperta Foundation 开发的 OpenEyes 3.5.1 中发现了一个存储型跨站脚本（XSS）漏洞。 'Address1' 参数中的输入处理不当，导致 JavaScript 可以被注入到患者档案中。当 Web 浏览器加载患者档案时，JavaScript 就会执行。这可能被用来对查看患者档案的不知情用户发动 XSS 攻击。 复现步骤 1. 浏览到某个患者档案。 2. 点击屏幕顶部附近的 '编辑图标'。 3. 在...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2025-7062 Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

EUVD-2025-210874

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

CVE-2025-7062 Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

CVE-2025-7062

CVE-2025-7062 is a stored cross-site scripting (XSS) vulnerability in the H5P module h5p-nodejs-library by Lumi Education UG , affecting versions up to and including 10.0.4 . The library allows users to upload H5P content containing malicious JavaScript, which is then executed in the browsers of ...

CVE-2026-34621

Adobe Acrobat Zero-Day Analysis Reverse-engineering notes and supporting material for an analysis of the Adobe Acrobat JavaScript trust model and its relation to the reported zero-day abuse path involving privileged Acrobat APIs. Overview This repository contains a technical analysis of how Adobe...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 fails to validate the order key before embedding order data in the front-end JavaScript configuration (via the order-pay endpoint). This allows unauthenticated users to enumerate sequential order identifiers and retrieve bi...

CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2025-55854-PoC

CVE-2025-55854 - Vulnerabilidad de Cross-Site Scripting XSS Almacenado Resumen de la Vulnerabilidad ID CVE: CVE-2025-55854 Tipo de Vulnerabilidad: Cross-Site Scripting XSS Almacenado Severidad: Alta Componente Afectado: Campo Bio del Perfil de Usuario Aplicación Afectada: FreelanceHub...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

CVE-2025-0054

CVE-2025-0054 – SAP NetWeaver 存储型XSS扫描器 🕷 一个轻量级的Python工具，用于检测 SAP NetWeaver Application Server Java 中的存储型跨站脚本（XSS）漏洞，专门针对 CVE-2025-0054 。 ⚠️ 仅供 教育和授权安全测试 使用。请 勿 在未经许可的系统上使用。 关于漏洞 CVE-2025-0054 是 SAP NetWeaver Java 系统中的一个存储型XSS漏洞，允许拥有低权限的攻击者将恶意 JavaScript 注入服务器，当用户访问受影响的页面时，该脚本会被存储并执行。 功能...