CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

CVE-2026-92411

The WP Delicious WordPress plugin (versions prior to 1.10.8 ) is vulnerable to Stored XSS . The root cause is a failure to validate or escape the HTML tag name extracted from user-supplied recipe block data before it is rendered on the front end. This allows authenticated users with the Contribut...

EUVD-2026-87535

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

ie11_vbscript_exploit

IE11 VBScript Exploit Exploit Generator for CVE-2018-8174 & CVE-2019-0768 RCE via VBScript Execution in IE11 Prerequisite Metasploit msfvenom Usage python ie11vbscript.py Listener IP Listener Port Instruction 1. Use this script to generate "exploit.html" 2. Host the html file on your server 3...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...

CLEANSTART-2026-HE86842 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy Una biblioteca para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Compatible con Java 7+. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no proporcionen código malicioso en el HTML que envían para su...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy Una librería para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Compatible con Java 8+. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para ...

tryhackme-moniker-link

tryhackme-moniker-link Documentación de mi laboratorio práctico Moniker Link CVE-2024-21413 completado en TryHackMe. Moniker Link CVE-2024-21413 — Laboratorio de TryHackMe Resumen Este repositorio documenta mi estudio práctico en una sala de TryHackMe. El objetivo de este ejercicio era comprender...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-71483

The Horilla HR and CRM software (prior to version 1.6.0 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the lack of HTML neutralization when the search parameter at /employee/employee-filter-view is reflected by jQuery's .html() function in employee/templates/emp...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Múltiple Inyección de HTML en Yordam-Kütüphane-Otomasyonunda CVE-2026-77818 · CVSS 3.1 6.1 Media · Presidencia de Ciberseguridad · Publicado 2026-09-04 · TR-26-1011 Estado: Las vulnerabilidades se han corregido en la versión v22.2. Las instalaciones afectadas deben actualizarse a v22.2 o superior...

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 POC de SSRF en Pandoc Una vulnerabilidad de Server-Side Request Forgery SSRF en JGM Pandoc v3.6.4 permite a los atacantes obtener acceso y comprometer toda la infraestructura mediante la inyección de un iframe manipulado. Instalar Pandoc https://pandoc.org/installing.html Ejemplo d...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2022-44311

Descripción de CVE-2022-44311 Se descubrió que html2xhtml v1.3 contiene una lectura fuera de los límites en la función static void elmclosetreenodet nodo en procesador.c. Esta vulnerabilidad permite a los atacantes acceder a archivos sensibles o provocar una denegación de servicio DoS mediante un...

CVE-2026-84463

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-63216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

CVE-2026-63206

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...