Prism 代码注入漏洞

Prism is an application from the US-based individual developers of Prism. It is a lightweight, extensible syntax highlighting tool. A security vulnerability exists in Prism 1.29.0 and earlier versions, which stems from the fact that document.currentScript lookups can be obscured by an attacker's...

whiteboomerang.com Cross Site Scripting vulnerability OBB-4030998

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CMSimple Cross-Site Scripting Vulnerability (CNVD-2026-00534)

CMSimple is a free content management system. CMSimple suffers from a cross-site scripting vulnerability that arises from insufficient filtering or escaping of user-supplied input. An attacker could use this vulnerability to execute arbitrary web script or HTML code to steal a user's session...

SUSE-SU-2025:0735-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.46.6 bsc1236946, bsc1234851: - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user. - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection. - CVE-2025-24158:...

CVE-2025-27330

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through = 2.23...

CVE-2025-27347

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct-checkout-button allows Stored XSS.This issue affects Direct Checkout Button for WooCommerce: from n/a through = 1.0...

PT-2025-7832 · Unknown · Rustaurius Front End Users

Name of the Vulnerable Software and Affected Versions: Rustaurius Front End Users versions 3.2.30 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of malicious scrip...

Cross-site Scripting (XSS)

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization in the question bank filter. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious scrip...

CVE-2025-26973 WordPress Social Warfare Plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-Based XSS.This issue affects Social Warfare: from n/a through = 4.5.5...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the $GET"id" parameter because of improper user input sanitization. An attacker can execute arbitrary code or access sensitive user information by injecting malicious scripts into this parameter. Details...

SUSE-SU-2025:0639-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.46.6 bsc1236946: - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user. - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection. - CVE-2025-24158: Processing web...

WordPress .htaccess Login block Plugin <= 0.9a - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin .htaccess Login block versions = 0.9a...

Exploit for SQL Injection in Eniture Ltl_Freight_Quotes

CVE-2024-13478 LTL Freight Quotes – TForce Edition = 5.6 AND e...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2025-23840

CVE-2025-23840 : Reflected Cross-Site Scripting in the WP-NOTCAPTCHA WordPress plugin (affecting WP-NOTCAPTCHA versions up to 1.3.1). Root cause: improper neutralization of input during web page generation. Consequences described include the ability for an attacker to trigger XSS when a victim vi...

Web Security Training

This document is aimed at those who want to learn more about web security and application penetration testing. It is coupled with a free course and provides topics with a few bullet points describing what the vulnerability entails, then a screenshot and relevant payload, demonstrating the...

Vulnerability-learning

It is an offensive tool for web application security. The reposi...

CVE-2025-23905 WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through = 0.9.7...

CVE-2025-24616 WordPress Uix Page Builder Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through = 1.7.3...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to incorrect handling of template literals in regular expressions. An attacker can manipulate the output of the script by...