CVE-2021-30809-OOM

CVE-2021-30809 — Apple WebKit 释放后重用漏洞（崩溃 PoC） https://github.com/user-attachments/assets/e81f8a01-d48d-44cc-a38f-ce59b01222d5 概述 本仓库包含一个针对 CVE-2021-30809（WebKit 释放后重用漏洞）的极简崩溃触发框架。PoC 通过处理精心构造的 Web 内容来利用漏洞代码路径，旨在可靠地触发浏览器崩溃（非完整利用）。它严格用于研究、调试和回归测试。 目标引擎：WebKit（例如 WebKitGTK / WPE WebKit，内嵌于设备中的旧版本分支）...

CVE-2024-37742

CVE-2024-37742: SEB ≤ 3.5.0（Windows）中的剪贴板利用漏洞 本仓库包含针对 CVE-2024-37742 的概念验证（PoC），该漏洞存在于 Windows 平台上的 Safe Exam Browser SEB ≤ 3.5.0 中。该漏洞允许攻击者在 SEB 考试模式与底层系统之间共享剪贴板数据，从而破坏考试完整性。通过利用此缺陷，攻击者可以绕过考试控制并在考试过程中获得不公平的优势。 免责声明 本仓库仅用于教育目的。此处提供的信息旨在帮助开发人员了解漏洞并保护其系统。请勿恶意或未经许可使用此漏洞。使用本 PoC...

POC-CVE-2024-6778

CVE-2024-6778 Este repositorio contiene pruebas de concepto proof-of-concept para CVE-2024-6778, que son vulnerabilidades en el navegador web Chromium que permiten una evasión de la sandbox a través de una extensión del navegador. Para ejecutar estos exploits, necesitas una versión de Chromium...

CVE-2023-0264

PoC para CVE-2023-0264 Vulnerabilidad de Keycloak que permite el secuestro de sesión durante el flujo de código de autorización Ver https://github.com/advisories/GHSA-9g98-5mj6-f9mv Requisitos previos Docker curl jq python3 u otra herramienta para servir archivos estáticos en HTTP Pasos para...

wraith

WRAITH — framework de hooks para navegador Un framework moderno y autónomo de hooks para navegador, pensado para equipos rojos, investigadores de seguridad y educadores: un sucesor de código limpio de BeEF y de las herramientas de callback blind-XSS que usamos a diario. SOLO PARA PRUEBAS DE...

DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

1. Robo de Tarjetas de Crédito – Extracción de Datos de Tarjetas El análisis de memoria con Process Hacker revela que DarkTortilla RAT se dirige a la información de tarjetas de crédito, incluidos números de tarjeta, fechas de vencimiento y tipos de tarjeta. Cadenas Clave Observadas:...

CVE-2026-73641 Multiple Reflected XSS in Dayforce Payroll

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...

FullscreenBrowserPhishing

Phishing mediante el modo de pantalla completa en el navegador Para empezar, me gustaría señalar que el phishing es ilegal y este proyecto es solo con fines educativos. El proyecto en este repositorio es solo una PoC para mostrar cómo se puede hacer y por eso la versión pública tiene fallos : Dem...

CVE-2026-7171 Stored Cross-Site Scripting (XSS) in TPVEnlanube

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.useradd&userid=45&option=comvirtuemart'. Successful exploitation of this vulnerability could allow an...

CVE-2025-24963

CVE-2025-24963 - Modo Navegador de Vitest - Lectura de Archivos Locales CVE-2025-24963 es una vulnerabilidad de severidad media puntuación CVSS 3.1: 5.9 que afecta al paquete @vitest/browser, un componente del marco de pruebas Vitest impulsado por Vite. Esta vulnerabilidad surge de una validación...

Cross Site Scripting

Apache Wicket is vulnerable to Cross Site Scripting. The vulnerability is due to improper neutralization of input during web page generation, where org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions writes attribute names and values from getAdditionalAttributes direct...

vi-bot

BotDetect v2 — 生产环境机器人检测库 客户端机器人与自动化检测库，具备加权评分、行为分析、浏览器指纹识别及可配置阈值。可检测无头浏览器、Selenium、Puppeteer、Playwright、基于CDP的工具以及隐身自动化框架。 v2.1.0 — 反检测蜜罐、GPU稳定的Canvas指纹识别、增强的行为分析、惰性初始化、服务端篡改检测、请求指纹绑定及速率限制。 目录 功能特性 架构 快速开始 客户端 API 服务端集成 检测模块 配置 生产环境检查清单 测试 功能特性 28 个检测模块 ，覆盖自动化框架、无头浏览器、指纹识别、行为分析、蜜罐及堆栈跟踪陷阱 加权评分系统 ...

CVE-2026-7171: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.useradd&userid=45&option=comvirtuemart'. Successful exploitation of this vulnerability could allow an...

CVE-2026-101900: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101902: Improperly Controlled Modification of Object Prototype Attributes

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

[SECURITY] Fedora 44 Update: chromium-154.0.8037.57-1.fc44

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2026-100694

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...

CVE-2026-100694 Hugo before 0.166.0 Cross-Site Scripting via text/org

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Browser extension relay, which reserves entries in a single global pending-authentication pool before a client proves possessi...

CVE-2026-100589

OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform ho...