68862 matches found
Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...
Label Studio - Cross-Site Scripting
Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...
Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)
It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2712 info: name: Yonyou UFIDA ERP-NC V5.0 -...
Lodash Template - Server-Side Template Injection (RCE)
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...
Mongo-Express - Remote Code Execution
Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...
CVE-2022-40317
CVE-2022-40317 XSS almacenado en Notas Se encontró un XSS almacenado en la sección de notas de la aplicación mientras pentesteábamos un cliente que usaba OpenKM. Básicamente, al almacenar notas, de alguna manera se permitía HTML normal y se renderizaba tal cual. Como saben, las etiquetas Sin...
Malicious code in pixsvg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f6989954f196f485ff049ef7dc22bb800a57187e6bdc8bd0e002ed4bbc1db7 The pixsvg module exports fetchDataFromSvgsvgData, which scans the input SVG for a comment of the form , reassembles the binary-encoded 1/0 sequence...
Malicious code in json-bigint-rs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...
js-driveby-download-CVE-2006-4777
js-driveby-download-CVE-2006-4777 client-side malware exploiting vulnerability in Internet Explorer 6.0 SP1 on Windows XP SP2. Requires no user consent and does not download any file. Shell Code Injection into RAM from JavaScript with IE on Windows XP. Fileless, drive-by-download, client side...
CVE-2025-55580
CVE-2025-55580 - SolidInvoice Cross-Site Scripting XSS Almacenado en Clientes Resumen SolidInvoice es vulnerable a un problema de Cross-Site Scripting XSS Almacenado en el Módulo de Clientes. Un atacante autenticado puede inyectar JavaScript arbitrario en la aplicación, el cual se ejecutará en lo...
cve-2019-11707
SpiderMonkey - CVE-2019-11707 Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 Capturas de pantalla Archivos exploit.js - Exploit real, precedido por los util.js y Int64.js de saelo. stager.js - Se utiliza para crear constantes, precedido por los util.js y Int64.js de saelo...
wonitor
web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...
frida-snippets
& también ejemplos de salida Índice de Contenidos Nativo Cargar módulo C/C++ Watchpoint único Actividad de socket Interceptar open Ejecutar comando de shell Listar módulos Registrar consulta SQLite Registrar argumentos de método Interceptar módulo completo Volcar segmentos de memoria Escanear...
CVE-2025-50866
CloudClassroom-PHP-Project 1.0 contiene una vulnerabilidad de Cross-site Scripting XSS reflejado en el parámetro email del endpoint postquerypublic. Una sanitización inadecuada permite a un atacante inyectar código JavaScript arbitrario que se ejecuta en el contexto del navegador del usuario, lo...
EUVD-2026-89476
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...
JSShell
JSShell 2.0 Un shell de JavaScript interactivo multiusuario basado en la web. Fue creado inicialmente para depurar navegadores esotéricos remotos durante experimentos e investigación. Esta herramienta se puede adjuntar fácilmente a cargas útiles XSS Cross Site Scripting para lograr la ejecución...
CVE-2025-57389
CVE-2025-57389 - XSS reflejado en OpenWRT 18.06.2 Descripción Se identificó una vulnerabilidad de cross-site scripting XSS reflejado en Luci OpenWRT v18.06.2 EOL en el endpoint /cgi-bin/luci/admin/system/packages. Prueba de concepto 1. Mientras se intercepta el tráfico con Burp, navegue a...
Linux Distros Unpatched Vulnerability : CVE-2026-102414
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than t...
