xsssniper

XSSSNIPER xsssniper es una práctica herramienta de descubrimiento de XSS con funcionalidades de escaneo masivo. Uso: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to us...

CVE-2026-108725

The Cheshire Cat AI core (versions through 2.0.23 ) contains a stored cross-site scripting (XSS) vulnerability within the uploads plugin . The root cause is a lack of file type restrictions, allowing authenticated users to upload HTML files via POST /uploads. An attacker can then trick a signed-i...

CVE-2026-108725 Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/path URL to a signed-in victim, executing...

EUVD-2026-96891

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/path URL to a signed-in victim, executing...

CVE-2026-108725 Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/path URL to a signed-in victim, executing...

CVE-2026-108722 open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

CVE-2026-108722

The open-computer-use project (specifically through commit 610bac8) is vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Logger.write_log_file function within os_computer_use/logging.py, which fails to perform HTML escaping when writing transcript text into log.html...

CVE-2026-108722 open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

burpsuite-copy-as-xmlhttprequest

Extensión Copy as XMLHttpRequest para BurpSuite La extensión añade un menú contextual a BurpSuite que permite copiar múltiples solicitudes como XmlHttpRequest de Javascript, lo que simplifica el desarrollo de PoC al explotar XSS. Instalación descarga el último JAR desde releases o constrúyelo...

CVE-2025-63499

Targeted Reflected XSS in theme parameter Researchers: Arseniy Poblaguev, Daniil Khomichenok Affected Versions = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Date: 02.12.2025 In the theme parameter there are Reflected XSS Vulnerability:...

HW-Pyton-10

CVE-2020-11022 Brief description CVE-2020-11022 is a Reflected XSS Cross-Site Scripting vulnerability related to incorrect processing of user input that is reflected in the HTML response without escaping. An attacker can inject JavaScript code that will execute in the user's browser...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2026-108566

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

apidetector

APIDetector es una herramienta potente y eficiente diseñada para probar endpoints Swagger expuestos en varios subdominios con capacidades inteligentes únicas para detectar falsos positivos. Es particularmente útil para profesionales de la seguridad y desarrolladores que realizan pruebas de API y...

CVE-2025-61183

CVE-2025-61183 Stored XSS in User Avatar Upload via Unsafe SVG Handling Overview A Stored Cross-Site Scripting XSS vulnerability was identified in the vaahcms, specifically within the interaction between the file upload logic in MediaController.php and the storeAvatar method in UserBase.php,...

infernal-twin

Infernal-Wireless v3 Versión 3 Mejoras y compatibilidad en Kali Linux 2018 Añadida representación visual del escaneo inalámbrico Añadida representación visual de las solicitudes de sonda y mapa por SSID solicitado por dispositivos Actualizado el mapeo de direcciones MAC Añadido mapeo de direccion...

CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Code execution from /core/shortcodes/class-wpbookit-shortcode-abstract.php:20-27: $wpbcustomcode= getoption 'wpbcustomcodedata', 'csscode' = '', 'jscode' = ...

bluemonday

bluemonday bluemonday es un sanitizador HTML implementado en Go. Es rápido y altamente configurable. bluemonday toma contenido generado por usuarios no confiable como entrada, y devolverá HTML saneado contra una lista blanca de elementos y atributos HTML aprobados para que puedas incluir el...

CVE-2026-108566 InstantSoft icms2 Private Message index.tpl.php index cross site scripting

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

EUVD-2026-96869

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...