VUL4J-59

jsoup: analizador HTML en Java que da sentido al HTML del mundo real. jsoup es una biblioteca Java para trabajar con HTML del mundo real. Proporciona una API muy conveniente para extraer y manipular datos, utilizando lo mejor de DOM, CSS y métodos similares a jQuery. jsoup implementa la...

VUL4J-60

antisamy Una biblioteca para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para su perfil, comentarios...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

authcov

AuthCov Web 应用程序授权覆盖扫描。 简介 AuthCov 使用 Chrome 无头浏览器，以预定义用户的身份登录，爬取您的 Web 应用程序。在爬取阶段，它会拦截并记录 API 请求以及加载的页面。下一阶段，它会以另一个用户账户（即“入侵者”）登录，并尝试访问之前发现的每一个 API 请求或页面。对于定义的每个入侵者用户，重复此步骤。最后，它会生成一份详细报告，列出发现的资源以及入侵者用户是否能够访问这些资源。 扫描本地 Wordpress 实例生成的示例报告： 功能特性 支持单页应用和传统多页应用 处理基于令牌和基于 Cookie 的身份验证机制 生成 HTML 格式的深入...

LinkedInt

赞助开源工具开发 欢迎赞助我以维护该工具：https://github.com/sponsors/vysecurity 免责声明 本项目仅用于教育和测试目的。 作者 LinkedInt 由 Vincent Yiu @vysecurity 开发：https://www.vincentyiu.com | https://vysecurity.rocks 原始爬虫由 Danny Chrastil @DisK0nn3cT 编写：https://github.com/DisK0nn3cT/linkedin-gatherer 贡献者： Leesoh harshil-shah004 安装 git...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

CVE-2026-97723

The madpsy ka9q_ubersdr software, in versions before 0.1.58 , is susceptible to a stored cross-site scripting (XSS) vulnerability within the chat message rendering functionality. The root cause is the insufficient neutralization of user-controlled URLs before they are converted into HTML links. S...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

CSRF-exploit-generator

CSRF-exploit-generator El generador de exploits CSRF permite a los usuarios generar un formulario de explotación CSRF con parámetros configurables. CSRF-exploit-generator Características URL de destino de entrada: Especifica la URL que se va a explotar. Parámetros POST de entrada: Permite añadir...

bleach

Bleach 注意：2026-06-05：Bleach 已不再维护。未来将不会发布任何版本，包括安全问题的修复。 参见 Issue： Bleach 是一个基于允许列表的 HTML 清洗库，用于转义或去除标记和属性。 Bleach 还可以安全地将文本转换为链接，应用 Django 的 urlize 过滤器无法处理的过滤，并可选地设置 rel 属性，即使文本中已存在链接也是如此。 Bleach 旨在清洗来自不可信 来源的文本。如果您发现自己煞费苦心地让网站管理员做很多事情，那么您可能已经超出了使用场景。要么信任这些用户，要么不要。 由于它依赖于 html5lib，Bleach 在处理怪异、古...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU Bison vulnerability (USN-8777-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8777-1 advisory. It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when generating HTML reports. An attacker cou...

MiracleLinux 9 : skopeo-1.22.2-8.el9_8 (AXSA:2026-1913:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1913:05 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive...

CVE-2026-84463: Improper Neutralization of Input During Web Page Generation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-71483: Improper Neutralization of Input During Web Page Generation

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

attackmapper

AttackMapper 攻击路径可视化与威胁情报平台 功能特性 • 安装 • 使用 • 威胁情报 • 贡献 概述 AttackMapper 是一款用于红队行动的 CLI 工具，可生成攻击路径、将技术映射到 MITRE ATT&CK 框架，并集成实时威胁情报。生成带有攻击流可视化的交互式 HTML 报告。 功能特性 功能特性| 描述 ---|--- 攻击路径映射| 可视化从侦察到影响的完整杀伤链 MITRE ATT &CK 集成| 技术映射到官方 ATT&CK 框架 实时威胁情报| 实时 CVE、威胁行为者和热门 TTP 多基础设施支持| AD、AWS、Azure、GCP 和网络攻击路径...

OutlookLeakTest

¡El Proyecto de Prueba de Fugas HTML de Outlook! Publicación del blog: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/smb-hash-hijacking-and-user-tracking-in-ms-outlook/ ¿Qué hay en "./Schemes-List.xlsx"? Lista de esquemas de URI que podrían funcionar en Windows. Estos...

CVE-2025-52204

CVE-2025-52204 – Znuny customer.pl 端点中的反射型XSS/HTML注入 摘要 Znuny 存在反射型跨站脚本（XSS）和 HTML 注入漏洞，攻击者可通过系统配置 CustomerPanelSessionName 定义的参数在 customer.pl 端点注入任意 JavaScript 或 HTML。 分类 CVE: CVE-2025-52204 CWE: CWE-79 – 网页生成过程中输入的不当中和（'跨站脚本'） CVSS v3.1（研究人员评估）： 6.1 中等 CVSS Vector:...