CVE-2021-46071

CVE-2021-46071 Título del Exploit: Vehicle Service Management System - 'Category List' Cross Site Scripting XSS Almacenado Autor del Exploit: SANU P.L CVE: CVE-2021-46071 CVSS: 4.8 MEDIO Referencias:...

CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147: Stored Cross-Site Scripting XSS in OpenSourcePOS...

Vehicle-Service-Management-System-Service-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46072 Exploit Title: Vehicle Service Management System - 'Service List' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46072 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-service-list-stored-cross-site-scripting-xss...

CVE-2024-23176

A flaw was found in the MassMessage extension of MediaWiki. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into web pages viewed by other users. The flaw occurs when a specially crafted URL, specifically Special:MassMessage?uselang=x-xs...

CVE-2021-46068

CVE-2021-46068 Título del Exploit: Vehicle Service Management System - Cross Site Scripting Almacenado XSS en 'MyAccount' Autor del Exploit: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIA Referencias: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

Malicious code in webpackbootstrapscripts (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...

CVE-2024-4367

CVE-2024-4367 POC 使用 root@kitploit: python poc.py mal.pdf "alert'0xr2r'" 参考 CVE-2024-4367: PDF.js 中的任意JS执行 PDF.js POC 扫描器 模板...

CVE-2016-10993

CVE-2016-10993 WordPress漏洞 - XSS（跨站脚本） 漏洞位置 https://themesinfo.com/scoreme-wordpress-theme-design-496 概念验证（PoC） https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E 参考 https://wpscan.com/vulnerability/8431...

CVE-2023-6000-POC

概述 CVE-ID : CVE-2023-6000 CVSS 评分 : 6.1 类型 : 存储型 XSS 修复版本 : Popup Builder 4.2.3 此漏洞允许攻击者利用 WordPress Popup Builder 插件中的跨站脚本（XSS）缺陷。 该插件未能阻止普通用户修改现有弹窗，攻击者可通过向服务器发送特制请求，在弹窗中注入恶意脚本，当用户与弹窗交互时脚本即执行。 对于本 POC，漏洞将通过操控弹窗打开行为触发，注入一个简单的 alert 脚本，在弹窗打开时运行。 此类攻击可导致一系列问题，包括未经授权访问敏感信息以及对受影响网站的进一步利用，可能危及用户数据或整个网...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - 跨站脚本攻击 概念验证PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md 概念验证PoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CVE-2022-38553

CVE-2022-38553 关于"ACADEMY LEARNING MANAGEMENT SYSTEM" POC 视频： 安全风险： 此安全漏洞允许攻击者在用户访问其准备好的URL时，在用户浏览器中执行任意JavaScript代码。...

CVE-2024-22890

CVE-2024-22890: My e-Diary App - 跨站脚本攻击 概念验证PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md 概念验证PoC : https://github.com/BurakSevben/CVE-2024-22890/blob/main/CVE-2024-22890.md...

CVE-2023-30212

CVE-2023-30212 实验室搭建 先决条件 下载 docker.io sudo apt install -y docker.io 步骤 1. 使用以下命令从我的仓库下载所有文件。 git clone https://github.com/AAsh035/CVE-2023-30212.git 2. 现在运行以下命令创建 Docker 镜像： sudo docker build -t vuln . 3. 接下来将 Docker 镜像转换为容器。容器需要在 80 端口运行。命令如下： sudo docker run -d -p 80:80 vuln 4. 使用以下命令检查容器是否运行：...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89243 WWBN AVideo Stored XSS via UserGroups setGroup_name

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

EUVD-2026-75930

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2026-89859

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...