CVE-2026-87477

A flaw was found in Core in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation would result in the leakage of sensitive information...

CVE-2026-87459

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Select component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-87641

A flaw was found in the Chromium Browser. A remote attacker could exploit a race condition by enticing a user to visit a specially crafted HTML page. This vulnerability could allow the attacker to bypass system access restrictions...

CVE-2026-87478

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Autofill feature. This could be achieved by enticing a user to visit a specially crafted HTML page. Successful exploitation would allow the attacker to obtain sensitive information...

CVE-2026-87587

A flaw was found in Chromium. This use-after-free vulnerability in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2025-70849

CVE-2025-70849: Podinfoにおける格納型XSS 概要 Podinfo （KubernetesマイクロサービスをデモンストレーションするWebアプリケーション）において、セキュリティ脆弱性（CWE-79）が特定されました。/store機能では、認証されていないユーザーが任意のHTML/JSコンテンツをアップロードでき、格納型XSSを引き起こします。 脆弱性詳細 CVE ID: CVE-2025-70849 製品: Podinfo 影響を受けるエンドポイント: /store 脆弱性タイプ: 格納型クロスサイトスクリプティング（XSS） 影響を受けるバージョン:...

CVE-2026-79289

A flaw was found in Chromium. A remote attacker, after compromising the renderer process, could bypass site isolation by using a specially crafted HTML page. This could allow the attacker to access data or resources that should be isolated, potentially leading to further compromise of the user's...

wwwgrep

WWWGrep OWASP Foundation Web Respository Author: Mark Deen & Aditi Mohan Introduction WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed...

VUL4J-59

jsoup: 現実のHTMLスープを解析するJava HTMLパーサー jsoupは、現実のHTMLを扱うためのJavaライブラリです。DOM、CSS、jQueryのようなメソッドの利点を活かし、データの抽出や操作を行うための非常に便利なAPIを提供します。 jsoupはWHATWG HTML5仕様（http://whatwg.org/html）を実装しており、最新のブラウザと同じDOMにHTMLを解析します。 URL、ファイル、または文字列からHTMLを解析 DOMトラバーサルまたはCSSセレクタを使用してデータを検索・抽出 HTML要素、属性、テキストを操作...

VUL4J-60

antisamy 一个用于对来自不受信任来源的 HTML 执行快速、可配置清理的库。 换句话说：它是一个 API，可帮助你确保客户端不会在用于个人资料、评论等并持久化在服务器上的 HTML 中提供恶意的负载代码。对于 Web 应用而言，“恶意代码”通常指“JavaScript”。大多数情况下，级联样式表只有在调用 JavaScript 时才会被视为恶意。然而，在许多情况下，“正常的”HTML 和 CSS 也可能被以恶意的方式利用。 如何使用 首先，从 Maven 添加依赖： root@kitploit: org.owasp.antisamy antisamy 1.5.5 如何构建...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

authcov

AuthCov 웹 애플리케이션 권한 부여 범위 스캐닝. 소개 AuthCov는 미리 정의된 사용자로 로그인한 상태에서 Chrome 헤드리스 브라우저를 사용하여 웹 애플리케이션을 크롤링합니다. 크롤링 단계에서 로드된 페이지뿐만 아니라 API 요청을 가로채서 기록합니다. 다음 단계에서는 다른 사용자 계정침입자으로 로그인하여 이전에 발견된 각 API 요청이나 페이지에 접근을 시도합니다. 정의된 각 침입자 사용자에 대해 이 단계를 반복합니다. 마지막으로 발견된 리소스와 침입자 사용자가 해당 리소스에 접근할 수 있는지 여부를 나열하는 상...

LinkedInt

오픈 소스 도구 후원 도구 유지 관리를 위해 후원해 주세요: https://github.com/sponsors/vysecurity 면책 조항 이 프로젝트는 교육 및 테스트 목적으로만 사용되어야 합니다. 저자 LinkedInt - Vincent Yiu @vysecurity 작성: https://www.vincentyiu.com | https://vysecurity.rocks 원본 스크래퍼 - Danny Chrastil @DisK0nn3cT 작성: https://github.com/DisK0nn3cT/linkedin-gathere...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

CVE-2026-97723

The madpsy ka9q_ubersdr software, in versions before 0.1.58 , is susceptible to a stored cross-site scripting (XSS) vulnerability within the chat message rendering functionality. The root cause is the insufficient neutralization of user-controlled URLs before they are converted into HTML links. S...

CVE-2021-40444

CVE-2021-40444 使用方法 最初に setup.sh を実行してください。いくつかのディレクトリが必要になります。スクリプトを実行すると、以下の例で gen.py を実行できるようになります:- root@kitploit: Usage python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t html/template.html -c payload.cab -f nothing.inf -r Sample2.docx -obf 3 Flag -d - O...