Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Omnibox component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Low...

CVE-2020-13942

CVE-2020-13942 Apache Unomi 预认证远程代码执行 CVE-2020-13942 利用 POST /context.json HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/72.0.3626.81 Safari/537.36 SE 2.X MetaSr 1.0 Content-Type: application/json Content-Length: 200 "filters":"i...

CVE-2021-46071

CVE-2021-46071 Título del Exploit: Vehicle Service Management System - 'Category List' Cross Site Scripting XSS Almacenado Autor del Exploit: SANU P.L CVE: CVE-2021-46071 CVSS: 4.8 MEDIO Referencias:...

CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147: Stored Cross-Site Scripting XSS in OpenSourcePOS...

Vehicle-Service-Management-System-Service-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46072 エクスプロイトタイトル: Vehicle Service Management System - 'Service List' 格納型クロスサイトスクリプティング XSS エクスプロイト作者: SANU P.L CVE: CVE-2021-46072 CVSS: 4.8 中 参考情報: https://www.plsanu.com/vehicle-service-management-system-service-list-stored-cross-site-scripting-xss...

CVE-2024-23176

A flaw was found in the MassMessage extension of MediaWiki. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into web pages viewed by other users. The flaw occurs when a specially crafted URL, specifically Special:MassMessage?uselang=x-xs...

CVE-2021-46068

CVE-2021-46068 エクスプロイトタイトル: Vehicle Service Management System - 'MyAccount' 格納型クロスサイトスクリプティング XSS エクスプロイト作成者: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIUM 参照: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

Malicious code in webpackbootstrapscripts (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...

CVE-2024-4367

CVE-2024-4367 POC 使い方 root@kitploit: python poc.py mal.pdf "alert'0xr2r'" 参照 CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC スキャナー templates...

CVE-2016-10993

CVE-2016-10993 WordPressの脆弱性 - XSS（クロスサイトスクリプティング） 脆弱性の場所 https://themesinfo.com/scoreme-wordpress-theme-design-496 概念実証 PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E 参考文献 https://wpscan.com/vulnerability/8431...

CVE-2023-6000-POC

概要 CVE-ID : CVE-2023-6000 CVSSスコア : 6.1 タイプ : 保存型XSS 修正バージョン : Popup Builder 4.2.3 この脆弱性により、攻撃者はWordPress Popup Builderプラグインのクロスサイトスクリプティング（XSS）の欠陥を悪用できます。 このプラグインは、一般の訪問者が既存のポップアップを変更することを防止できず、攻撃者が特別に細工したリクエストをサーバーに送信することで、 ポップアップに悪意のあるスクリプトを注入でき、ユーザーがポップアップとやり取りしたときに実行されます。...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - クロスサイトスクリプティング 概念実証PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md 概念実証PoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CVE-2022-38553

CVE-2022-38553 ACADEMY LEARNING MANAGEMENT SYSTEM POC 動画:...

CVE-2024-22890

CVE-2024-22890: My e-Diary App - クロスサイトスクリプティング 概念実証PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md 概念実証PoC : https://github.com/BurakSevben/CVE-2024-22890/blob/main/CVE-2024-22890.md...

CVE-2023-30212

CVE-2023-30212 ラボのセットアップ 前提条件 docker.io をダウンロードする sudo apt install -y docker.io 手順 1. 以下のコマンドを使用して、私のリポジトリからすべてのファイルをダウンロードします。 git clone https://github.com/AAsh035/CVE-2023-30212.git 2. 次に、Docker イメージを作成するために以下のコマンドを実行します。 sudo docker build -t vuln . 3. 次に、Docker イメージをコンテナに変更します。コンテナはポート 80...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89243 WWBN AVideo Stored XSS via UserGroups setGroup_name

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...