fuzzing-templates

Fuzzing Templates Community curated list of fuzzing templates for the nuclei engine to find unknown security vulnerabilities. Documentation • Contributions • Discussion • Community !Caution This repository is archived and merged into nuclei-templates project under /dast directory. Fuzzing templat...

angularjs-poc-cve-2022-25869

À propos Ceci est une preuve de concept minimale pour une vulnérabilité XSS dans un AngularJS affectant Internet Explorer CVE-2022-25869. Vous pouvez la voir en ligne à l'adresse https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 cssxn Souvenez-vous de la bouche sale de cette personne Oui, c'était une blague hier. Amusez-vous bien...

CVE-2019-10685

CVE-2019-10685 L'entrée fournie par l'utilisateur contenant du JavaScript est renvoyée dans du code JavaScript dans une réponse HTML via le paramètre "TextField". Publication Exploit-DB sur https://www.exploit-db.com/exploits/46804 Publication PacketStorm sur...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699 : Plusieurs XSS Réfléchis dans TastyIgniter v3.0.7 Restaurant CMS Une XSS réfléchie nécessitant une authentification existe dans le tableau de bord Admin de TastyIgniter version 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC : Paramètre start du tableau de bord admin : POST...

CVE-2021-43032

CVE-2021-43032 В XenForo ≤ 2.2.7 злоумышленник, имеющий доступ к панели администратора, может сохранить полезные нагрузки межсайтового скриптинга в любой функции приложения, которая принимает HTML-код. Полезная нагрузка, размещенная в функционале 'Реклама', будет выполняться глобально на стороне...

CVE-2023-37979

CVE-2023-37979 Vulnérabilité de Cross-Site Scripting XSS réfléchi non authentifié dans le plugin Saturday Drive Ninja Forms Contact Form versions = 3.6.25. PoC et Checker , à des fins éducatives uniquement 'python3 exploit.py https://target.com'...

EUVD-2026-96115

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-96116

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2026-96117

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-17025

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.4 . The root cause is insufficient input sanitization and output escaping within the 'Current location' and 'Author profile image URL' profile fields. This allows authentica...

CVE-2026-14335

The Easy Digital Downloads WordPress plugin (versions 3.6.9 and below ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping specifically within PayPal IPN Parameters . This allows unauthenticated attackers to i...

CVE-2026-14335 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-17025 Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-12054 Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-96113

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-96114

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-14882

The Brizy – Page Builder plugin for WordPress, versions up to and including 2.8.18 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping regarding the 'brizy-compiled-sections' parameter. This allows authenticated attackers wi...

CVE-2026-103912

The JetFormBuilder WordPress plugin (versions 3.6.6 and below ) is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the parameter. Unauthenticated attackers can inject arbitrary web scripts by tricking ...

CVE-2026-103912 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...