75475 matches found
EUVD-2026-114894
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the...
EUVD-2026-114904
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...
awesome-ctf
Awesome CTF A curated list of Capture The Flag CTF frameworks, libraries, resources, softwares and tutorials. This list aims to help starters as well as seasoned CTF players to find everything related to CTFs at one place. Contributing Please take a quick look at the contribution guidelines first...
HtmlSmuggling
HtmlSmuggling HTML smuggling is a malicious technique used by hackers to hide malware payloads in an encoded script in a specially crafted HTML attachment or web page. The malicious script decodes and deploys the payload on the targeted device when the victim opens/clicks the HTML attachment/link...
seeker
Available in Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website which asks for Location Permission and if...
pphack
pphack Advanced Client-Side Prototype Pollution Scanner Coded with 💙 by edoardottt Share on Twitter! Install • Get Started • Examples • Changelog • Contributing • License Install 📡 Using Go go install github.com/edoardottt/pphack/cmd/pphack@latest pphack relies on chromedp, so you need Chrome or...
JSpector
JSpector JSpector is a Burp Suite extension that passively crawls JavaScript files and automatically creates issues with URLs, endpoints and dangerous methods found on the JS files. Prerequisites Before installing JSpector, you need to have Jython installed on Burp Suite. Installation 1. Download...
katana
A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...
JSFScan.sh
JSFScan.sh Blog can be found at https://medium.com/@patelkathan22/beginners-guide-on-how-you-can-use-javascript-in-bugbounty-492f6eb1f9ea?sk=21500dc4288281c7e6ed2315943269e7 Script made for all your javascript recon automation in bugbounty. Just pass subdomain list to it and options according to...
JSShell
JSShell 2.0 An interactive multi-user web based javascript shell. It was initially created in order to debug remote esoteric browsers during experiments and research. This tool can be easily attached to XSS Cross Site Scripting payload to achieve browser remote code execution similar to the BeeF...
DVHMA
DVHMA Damn Vulnerable Hybrid Mobile App DVHMA is an hybrid mobile app for Android that intentionally contains vulnerabilities. Its purpose is to enable security professionals to test their tools and techniques legally, help developers better understand the common pitfalls in developing hybrid...
BurpCrypto
BurpCrypto Burpcrypto is a collection of burpsuite encryption plug-ins, supporting AES/RSA/DES/ExecJsexecute JS encryption code in burpsuite. English | 简体中文 Build $ mvn package Usage Download the precompiled jar package from Releases. Add this jar package to your burpsuite's Extensions. Switch to...
CVE-2026-111089
Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is the framework's failure to escape resource bundle texts (such as localized labels or CSS class names) when they are written into generat...
CVE-2026-95863
Apache Wicket is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The software fails to escape markup IDs and component IDs when they are written into generated JavaScript string literals. This allows an attacker to break out of the lite...
CVE-2026-84231
Apache Wicket versions 8.0.0 through 8.19.0 are vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization. When an ExternalLink component is bound to a non-anchor tag (like a button or span), the software builds a JavaScript click handler where the model URL is concatenated in...
CVE-2026-83559
The Apache Wicket framework is vulnerable to an improper encoding issue in org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes(). The method fails to escape backslashes before escaping quotes, allowing an attacker to break out of a JavaScript string literal if they can influence the i...
CVE-2026-83539
Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The issue exists in the SmartLinkLabel and SmartLinkMultiLineLabel components, which use DefaultLinkParser to automatically convert URLs found in text into ...
CVE-2026-82956
Apache Wicket is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input in the AjaxNewWindowNotifyingBehavior component. The vulnerability occurs because the component stores the client-supplied window.name value in the page's serialized state. During subsequent renders,...
fuzzilli
Fuzzilli A coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language "FuzzIL" which can be mutated and translated to JavaScript. Usage The basic steps to use this fuzzer are: 1. Download the source code for one of the supported JavaScript engines. See the...