Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...

CVE-2024-4367

CVE-2024-4367 POC 使い方 root@kitploit: python poc.py mal.pdf "alert'0xr2r'" 参照 CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC スキャナー templates...

CVE-2016-10993

CVE-2016-10993 Wordpress 취약점 - XSS 크로스 사이트 스크립팅 취약점 위치 https://themesinfo.com/scoreme-wordpress-theme-design-496 개념 증명 PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E 참고자료 https://wpscan.com/vulnerability/8431...

CVE-2023-6000-POC

概要 CVE-ID : CVE-2023-6000 CVSSスコア : 6.1 タイプ : 保存型XSS 修正バージョン : Popup Builder 4.2.3 この脆弱性により、攻撃者はWordPress Popup Builderプラグインのクロスサイトスクリプティング（XSS）の欠陥を悪用できます。 このプラグインは、一般の訪問者が既存のポップアップを変更することを防止できず、攻撃者が特別に細工したリクエストをサーバーに送信することで、 ポップアップに悪意のあるスクリプトを注入でき、ユーザーがポップアップとやり取りしたときに実行されます。...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - クロスサイトスクリプティング 概念実証PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md 概念実証PoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CVE-2022-38553

CVE-2022-38553 ACADEMY LEARNING MANAGEMENT SYSTEM POC 動画:...

CVE-2024-22890

CVE-2024-22890: My e-Diary App - 크로스 사이트 스크립팅 개념 증명PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md 개념 증명PoC : https://github.com/BurakSevben/CVE-2024-22890/blob/main/CVE-2024-22890.md...

CVE-2023-30212

CVE-2023-30212 실습 환경 설정 사전 요구사항 docker.io 다운로드 sudo apt install -y docker.io 단계 1. 아래 명령어를 사용하여 내 저장소에서 모든 파일을 다운로드하세요. git clone https://github.com/AAsh035/CVE-2023-30212.git 2. 이제 Docker 이미지를 만들기 위해 다음 명령어를 실행하세요: sudo docker build -t vuln . 3. 다음은 Docker 이미지를 컨테이너로 전환합니다. 컨테이너는 포트 80에서 실행되어야...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89243 WWBN AVideo Stored XSS via UserGroups setGroup_name

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

EUVD-2026-75930

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2026-89859

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

CVE-2026-79947

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

CVE-2026-79741

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...

CVE-2026-79946

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script...

CVE-2026-79689

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially explo...

CVE-2026-79947

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...