CVE-2026-73546: Improper Neutralization of Input During Web Page Generation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - 369行目 root@kitploit: .$thread-getTitle.''; 3. 他にもあります！ 根本原因: フォーラムのスレッドタイトルが適切なサニタイズなしに保存される スレッドタイトルが複数の場所で HTML エスケープされずに表示される XSS の実行を防ぐ Content Security Policy CSP がない 権限昇格のステップバイステップガイド フェーズ 1:...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner 一个通过从 HTML 页面获取勒索信息并比较字符串来扫描 IP 地址以发现 ESXi 被入侵迹象的程序。 要求 python 3.x requests BeautifulSoup tqdm colorama 安装 使用 pip 包管理器安装所需包。 root@kitploit: pip install requests pip install bs4 pip install tqdm pip install colorama 用法 使用 Python 3 运行程序： root@kitploit: python ESXiEZScanner.py ...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - 온라인 이벤트 부킹 및 예약 시스템 버전 2.3.0의 HTML 인젝션 취약점. 기술 설명: 온라인 이벤트 부킹 및 예약 시스템 버전 2.3.0에는 HTML 인젝션 취약점이 존재합니다. 공격자는 이 취약점을 악용하여 웹사이트에 표시되는 내용을 변경할 수 있습니다. 대상 사용자가 특정 링크를 클릭하면 공격자가 선택한 HTML 코드의 내용이 표시됩니다. 영향을 받는 구성 요소 - 취약한 페이지 - index.php 취약한 매개변수 - "msg" 악용 단계: 1...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection

CVE-2021-46079 エクスプロイトタイトル: Vehicle Service Management System - 「複数の」ファイルアップロードによりHTMLインジェクションが発生 エクスプロイト作成者: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 高 参考情報: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection...

decode-spam-headers

decode-spam-headers.py 日々の管理業務で特定のメールが SPAM/迷惑メールに振り分けられた理由を理解したい場合でも、Red-Team のフィッシングシミュレーションの目的であっても、このスクリプトは役立ちます! このアイデアは、MS Defender for Office365 を備えた商用 MS Office365 E5 環境を対象に、商用フィッシングシミュレーション演習を実施した際に生まれました。想像がつくと思いますが、フィッシングシミュレーションの観点から見ると、かなり強固なセキュリティスタックです。 手作業でこれらすべての Office365 SMTP...

CVE-2026-50980

CVE-2026-50980: DNSベースのクロスサイトスクリプティング XSS および oPanel におけるセッションハイジャック 概要 CVE ID: CVE-2026-50980 製品: oPanel 影響を受けるバージョン: v1.20.25 脆弱性の種類: 保存型クロスサイトスクリプティング XSS（DNS経由）/ セッションハイジャック 深刻度: 高 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N 説明 oPanel（v1.20.25 より前のバージョン）には、DNS...

CVE-2026-93981

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

EUVD-2026-83586

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-85680

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-93981: Improper Neutralization of Input During Web Page Generation

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-85271

Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...

CVE-2026-77607

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2025-53837

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

EUVD-2025-210935

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...