CVE-2026-103482

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2023-2822-demo

CVE-2023-2822-demo تطبيق Flask بسيط لإنشاء تطبيق ويب ضعيف عمدًا لعرض CVE-2023-2822. بناءً على المقالة على https://medium.com/@cyberninja717/reflected-cross-site-scripting-vulnerability-in-ellucian-ethos-identity-cas-logout-page-685bb1675dfb. docker build -t xss-demo . docker run -p :5000 xss-demo...

CVE-2019-17625

CVE-2019-17625 توجد ثغرة XSS مخزنة في Rambox 0.6.9 بسبب معلمات غير معقمة في حقل الاسم عند إضافة خدمة. بما أن Rambox يعمل على NodeJS، فهذا يسمح بحقن أوامر نظام التشغيل في وسم أو . ملاحظة: تم اختبار هذا الكود فقط على MacOS وقد يحتاج إلى إعادة تكوين لأنظمة تشغيل أخرى كود الاستغلال سينشئ كود الاستغلا...

dorkX

dorkX ربط أدوات مختلفة مع ماسح google dork الإصدار 1.0 التثبيت zoid@MSI /dorkX git clone https://github.com/ethicalhackingplayground/dorkX zoid@MSI /dorkX cd dorkX zoid@MSI /dorkX go build dorkx.go zoid@MSI /dorkX go build corsx.go zoid@MSI /dorkX go build csrfx.go zoid@MSI /dorkX go build zin.go...

s3cXSSer

s3cXSSer Cette extension vous aidera à détecter facilement les vulnérabilités XSS basées sur GET/POST sur n'importe quel site web. S3C - XSSER - Extension Chrome Comment l'ajouter à Chrome ou au navigateur Brave 1- Allez dans brave://extensions/ ou chrome://extensions/ 2- activez le mode...

CVE-2026-87780

The LTL Freight Quotes – Old Dominion Edition WordPress plugin versions before 4.2.19 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitise and escape values submitted via an unauthenticated endpoint before they are stored and subsequently rendered on an a...

EUVD-2026-96130

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it...

EUVD-2026-96128

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...

CVE-2026-107323

The Gallery PhotoBlocks WordPress plugin versions before 1.3.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape specific gallery settings before they are rendered into an HTML attribute. This allows users with Contributor-level acc...

CVE-2026-87780 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it...

CVE-2026-107323 Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...

EUVD-2026-96120

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-104754

The Rank Math SEO WordPress plugin (versions before 1.0.280 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to escape a stored redirection source value. An attacker with permissions to manage redirections (typically Administrators ) can inject malicious JavaScript that execu...

CVE-2026-104754 Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2022-1597

CVE-2022-1597 المكوّن الإضافي، المستخدم كرفيق لسمتَي Discy وHimer، لا يعقّم ويهرب من معامل في نموذج إعادة تعيين كلمة المرور مما يتيح تنفيذ هجمات البرمجة النصية عبر المواقع المنعكسة Reflected Cross-Site Scripting الإضافات المتأثرة: WPQA history.pushState'', '', '/' قالب Nuclei: CVE-2022-1597.yaml...

PoC_CVE-2024-28157

CVE-2024-28157 - XSS stocké dans le plugin Jenkins GitBucket GitBucket URL : javascript:alert77 3. Enregistrer, puis visiter la page du projet 4. L'alerte se déclenche avec 49 77 Les captures d'écran sont dans poc/screenshots/ Références NVD https://nvd.nist.gov/vuln/detail/CVE-2024-28157...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - Outil simple de preuve de concept 🛠 À propos de cette application Cet outil présente une preuve de concept technique PoC pour le problème de sécurité CVE-2026-2472. Ce problème affecte le SDK Python Vertex AI de Google Cloud Platform. Il s'agit d'une...

CVE-2026-17025

A flaw was found in graphene. Due to insufficient input sanitization and output escaping in user profile fields, an authenticated attacker with low-level privileges can conduct stored Cross-Site Scripting XSS attacks. By injecting malicious scripts into profile fields, an attacker can execute...

CVE-2025-56795

CVE-2025-56795 Description Deux vulnérabilités de type Cross-Site Scripting XSS stocké ont été identifiées dans la fonctionnalité de création de recettes de Mealie , affectant toutes les versions jusqu'à 3.0.1 incluse. Les entrées utilisateur non nettoyées fournies lors de la création d'une recet...