LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

Título del Exploit: LetterPress CLICK THIS" en el campo de entrada Mensaje de Campaña HTML y haz clic en Guardar Campaña. 2. Visualiza la campaña y haz clic en el hipervínculo "CLICK THIS"; te redirigirá al sitio de terceros. Ej.: evil.com...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension HTML tag: root@kitploit: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection

CVE-2021-46079 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Html Injection Exploit Author: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection...

viber-desktop-html-injection

Viber Desktop — HTML Injection CVE-2025-55996 CVE: CVE-2025-55996 Discoverer: Thaw Khant Cycbake Product: Viber Desktop Affected: Viber Desktop 25.6.0 and possibly earlier Summary Viber Desktop's deep-link handler viber://forward?text= can render unsanitized HTML supplied in the text parameter...

CVE-2024-30956

CVE-2024-30956 cf https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-based XSS HTML Injection vulnerability in TOWeb version 5 eg http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navigate to the url, the JS code is executed PS: src contains a copy ...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Múltiple Inyección de HTML en Yordam-Kütüphane-Otomasyonunda CVE-2026-77818 · CVSS 3.1 6.1 Media · Presidencia de Ciberseguridad · Publicado 2026-09-04 · TR-26-1011 Estado: Las vulnerabilidades se han corregido en la versión v22.2. Las instalaciones afectadas deben actualizarse a v22.2 o superior...

cve-disclosures

Divulgaciones de CVE — Aman Bahiniya Tres CVE asignados por MITRE en diciembre de 2024. Los registros fueron reservados pero nunca publicados, por lo que aún no hay nada indexado. Este repositorio publica los avisos para que los CVE sean buscables y acreditados...

CVE-2026-77607

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 prueba rápida root@kitploit: import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text o root@kitploit: POST /wp-login.php HTTP/1....

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 < Security 2026 Update 3 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, or 12.0 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in Esri Portal for ArcGIS that may under...

Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...

CVE-2026-77606: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

CVE-2026-48060

CVE-2026-48060 - Inyección HTML en Litestar a través del Token CSRF Este repositorio contiene la prueba de concepto del exploit y la aplicación vulnerable para demostrar la vulnerabilidad de inyección HTML presente en la versión 2.21.0 de Litestar. Cómo Ejecutar root@kitploit: git clone...

cve-2026-64638-banner-poc

CVE-2026-64638 — PoC de Banner Universal Un generador de PoC de un solo archivo y sin dependencias para la inyección de HTML reflejada CVE-2026-64638 de WordPress en wp-login.php diferencial entre striptags y el analizador KSES. Produce una página de activación con autoenvío: cuando la víctima ab...

CVE-2026-31281

CVE-2026-31281 Description Totara LMS is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser CVSS 3...

CVE-2025-55903

CVE-2025-55903: Inyección de HTML Almacenado en PerfexCRM ⚠️ Aviso de Seguridad Una vulnerabilidad crítica de Inyección de HTML Almacenado que afecta a facturas, facturación y comunicaciones automatizadas -ff6600 📋 Resumen Se ha descubierto una vulnerabilidad de Inyección de HTML Almacenado en...

CVE-2025-60378

CVE-2025-60378: Inyección de HTML Almacenado en RISE Ultimate Project Manager & CRM ⚠️ Aviso de Seguridad Una vulnerabilidad crítica de inyección de HTML almacenado que afecta a facturas, mensajería y comunicaciones automatizadas -ff6600 📋 Resumen Se ha descubierto una vulnerabilidad crítica de...

WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability

Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...