20810 matches found
CVE-2026-33331
CVE-2026-33331 — oRPC OpenAPI 참조 플러그인의 저장형 XSS orpc의 OpenAPI 문서 생성에서 발생하는 저장형 XSS에 대한 개념 증명 실습 환경 목적 oRPC는 OpenAPI 스펙을 기반으로 API 문서 페이지를 생성합니다. v1.13.9 이전 버전에서는 HTML 인코딩 없이 JSON.stringify를 사용하여 스펙을 태그에 직접 넣었습니다. 공격자가 제어할 수 있는 info.description과 같은 필드는 해당 태그를 조기에 닫고 스크립트를 실행할 수 있었습니다...
Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-
Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212- git clone을 사용하여 내 저장소에서 파일 다운로드 git clone https://github.com/JasaluRah/Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-.git 이제 docker 이미지를 설정합니다. docker 이미지 만들기 다음 명령어를 사용하세요 sudo docker build -t work . docker 컨테이너 실행 다음 명령어를 사용하세요...
CVE-2019-19393
Rittal CMC PU III – 저장형 XSS PoC 애플리케이션: Rittal CMC PU III 웹 관리 장치: CMC PU III 7030.000 소프트웨어 리비전: V3.11.002부터 V3.15.704까지 하드웨어 리비전: V3.00부터 V6.01까지 공격 유형: 저장형 XSS 해결 방법: 소프트웨어 리비전 V3.17.10 이상으로 업데이트 요약: 웹 애플리케이션이 시스템 구성 페이지에서 사용자 입력을 제대로 정화sanitize하지 못합니다. 이로 인해 공격자가 HTML 및 브라우저 해석 콘텐츠예: JS 또는 기타...
CVE-2026-91936
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...
CVE-2026-91936
Flowise versions before 3.1.4 are affected by a script injection vulnerability in its Docker image build workflows. The root cause is that workflow_dispatch inputs are directly interpolated into shell run blocks without sanitization. An attacker with repository write access can inject shell metac...
CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...
opmonster
OpMonster CVE-2020-8636 — 인증된 원격 코드 실행 익스플로잇 Opmon 대상 소개 • 설치 • 사용법 • 라이선스 소개 OpMonster는 Opmon 모니터링 플랫폼의 원격 코드 실행 취약점인 CVE-2020-8636 에 대한 개념 증명 익스플로잇입니다. 이는 nettools.php 엔드포인트를 악용하여 임의의 --script 옵션으로 Nmap을 실행할 수 있게 합니다. 익스플로잇은 Opmon이 사용자가 제어하는 서버에서 악성 Nmap 스크립트를 가져오도록 를 통해 한 후 에 저장한 다음 실행하여 대상에서...
EUVD-2026-78202
Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...
EUVD-2026-77586
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...
CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...
EUVD-2026-77580
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...
CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox
Because Firefox did not implement the unsafe-hashes CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy might have been able to inject executable scripts. This would be severely restricted by the specified Content Security Policy o...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the keyboard interface in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Omnibox component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Low...
CVE-2020-13942
CVE-2020-13942 Apache Unomi 事前認証RCE CVE-2020-13942 エクスプロイト POST /context.json HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/72.0.3626.81 Safari/537.36 SE 2.X MetaSr 1.0 Content-Type: application/json Content-Length: 200...
CVE-2021-46071
CVE-2021-46071 익스플로잇 제목: Vehicle Service Management System - 'Category List' 저장형 크로스 사이트 스크립팅 XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46071 CVSS: 4.8 MEDIUM 참조: https://www.plsanu.com/vehicle-service-management-system-category-list-stored-cross-site-scripting-xss...