Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...

CVE-2024-4367

Preuve de concept CVE-2024-4367 Utilisation root@kitploit: python poc.py mal.pdf "alert'0x2r2'" Références CVE-2024-4367 : Exécution arbitraire de JS dans PDF.js PDF.js Preuve de concept Scanner modèles...

CVE-2016-10993

CVE-2016-10993 Vulnérabilité WordPress - XSS Cross-Site Scripting Emplacement de la vulnérabilité https://themesinfo.com/scoreme-wordpress-theme-design-496 Preuve de concept PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E Références...

CVE-2023-6000-POC

Détails généraux CVE-ID : CVE-2023-6000 Score CVSS : 6.1 Type : XSS stocké Version corrigée : Popup Builder 4.2.3 Cette vulnérabilité permet à un attaquant d'exploiter une faille de type Cross-Site Scripting XSS dans le plugin WordPress Popup Builder. Le plugin ne parvient pas à empêcher les...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - Scripting intersite Preuve de concept PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md Preuve de concept PoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CVE-2022-38553

CVE-2022-38553 XSS SUR "ACADEMY LEARNING MANAGEMENT SYSTEM" VIDÉO POC:...

CVE-2024-22890

CVE-2024-22890 : Application My e-Diary - Cross-Site-Scripting XSS Preuve de concept PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md Preuve de concept PoC : https://github.com/BurakSevben/CVE-2024-22890/blob/main/CVE-2024-22890.md...

CVE-2023-30212

MISE EN PLACE DU LABORATOIRE CVE-2023-30212 Prérequis Télécharger docker.io sudo apt install -y docker.io ÉTAPES 1. Téléchargez tous les fichiers de mon dépôt en utilisant la commande ci-dessous. git clone https://github.com/AAsh035/CVE-2023-30212.git 2. Maintenant, pour créer une image Docker,...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89243 WWBN AVideo Stored XSS via UserGroups setGroup_name

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

EUVD-2026-75930

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2026-89859

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

CVE-2026-79947

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

CVE-2026-79946

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script...

CVE-2026-79741

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...

CVE-2026-79689

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially explo...

CVE-2026-79947

Dell SCG 5.0 (Secure Connect Gateway) is affected by an OS Command Injection vulnerability in both the Appliance (versions prior to 5.36.00.16 ) and Application (versions prior to 5.36.00.00 ). A low-privileged attacker with local access can exploit improper neutralization of special elements use...