CSPBypass

CSP Bypass CSPBypass.com へようこそ。このツールは、許可された特定のドメインのみを許可するCSPによってインジェクションがブロックされているサイトで、制限的なコンテンツセキュリティポリシー（CSP）をバイパスし、XSS（クロスサイトスクリプティング）脆弱性を悪用するための倫理的ハッカーを支援するために設計されています。 Website CSPBypass.com にアクセスして、XSSを可能にする既存のCSPバイパスガジェットを検索したり、独自の発見を貢献したりしてください。 Offline Usage...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

JSONBee

JSONBee 다양한 웹사이트의 콘텐츠 보안 정책을 우회하는 데 도움이 되는 바로 사용 가능한 JSONP 엔드포인트입니다. 이 도구는 키예프에서 열린 HackIT 2018에서 발표되었습니다. 발표 자료는 여기에서 찾을 수 있습니다슬라이드 형식이 왜 망가졌는지 모르겠네요 :D: https://www.slideshare.net/HackenEcosystem/ebrahem-hegazy-bug-hunters-manual-for-bypassing-contentsecuritypolicy JSONBee란 무엇인가? 이 도구의 주요 아이디어는...

poc-CVE-2026-64638-

XSS2Shell — CVE-2026-64638 PoC WordPressの事前認証XSS → RCEエクスプロイトチェーン。pwn.ai による研究に基づき、ionsec.io に公開されています。 ⚠️ 法的警告 : 教育目的 および許可されたテスト 専用です。所有するシステム、または明示的な書面による許可を得たシステムに対してのみ使用してください。 ラボ検証 手順| 手法| 状態 ---|---|--- 1| パーサー差分XSS sanitizeuser + ブラウザのパース差分| ✅ 検証済み 2| DOM clobbering , | ✅ 検証済み 3|...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

rosettaflash

Rosetta Flash CVE-2014-4671 Windows および OS X 上の Adobe Flash Player 13.0.0.231 より前のバージョンと 14.x の 14.0.0.145 より前のバージョン、Linux 上の 11.2.202.394 より前のバージョン、Android 上の Adobe AIR 14.0.0.137 より前のバージョン、Adobe AIR SDK 14.0.0.137 より前のバージョン、および Adobe AIR SDK & Compiler 14.0.0.137 より前のバージョンは、SWF...

CVE-2015-9251

CVE-2015-9251 [email protected] CVE-2015-9251（3.0.0 未満の jQuery）向けの PoC。 CVE-2015-9251 - PoC エクスプロイト このリポジトリには、jQuery ライブラリの脆弱性 CVE-2015-9251 に対する Proof of Concept（PoC） が含まれています。この脆弱性は、jQuery が 3.0.0 より前のバージョンで callback パラメータへのコード注入を許可していたため、サニタイズされていない JSONP...

PT-2026-104258

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted li...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

SummaryWhen enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instea...

PYSEC-2026-4113 Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

CVE-2026-49264

When "enablejsonp=True", oauthlib's "RevocationEndpoint" reflects the user-supplied "callback" parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

GHSA-HJ66-6F7G-4R5V Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

PT-2026-102980

Name of the Vulnerable Software and Affected Versions oauthlib versions 0.6.1 through 3.3.1 Description When the enable jsonp parameter is set to True, the RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths. Th...

BIT-SEAWEEDFS-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...

Malicious Package

Overview link-phoenix-jsonp-concurrently is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the handling of HTTP responses in the UI, Logviewer, and DRPC components. An attacker can access sensitive cluster, topology, and log data by enticing an authenticated user to visit a malicious web page that...

CVE-2026-82438

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

EUVD-2026-77514

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...