CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

EUVD-2026-98766

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...

CVE-2026-102342 ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...

CVE-2026-102342

The ammonia Rust library (prior to versions 3.3.3, 4.0.3, and 4.1.4) is vulnerable to stored cross-site scripting (XSS) . The root cause is that the library fails to apply attribute filters based on attributeName, allowing the contents of to, from, and values tags within SVG animate or set elemen...

CVE-2026-102342 ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...

CVE-2026-102342

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...

CVE-2022-1175

CVE-2022-1175 Gitlab Stored XSS, can be set in an issue on a project, either your own or another users. Allows attacks such as creating & stealing a Personal Access Token PAT of anyone who visits an issue. PAT's can then provide full Gitlab API access as that user equivilent to a full account...

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-26719

Description Summary A stored Cross‑Site Scripting vulnerability exists in xxl-job-admin JobInfoController.java where the addressList parameter accepts unsanitized URL‑encoded JavaScript. The payload is stored and later executed in users’ browsers, lead unauthorized actions. Affected Products...

CVE-2026-109960

Froxlor versions 2.0.0 before 2.3.14 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. Authenticated customers can inject malicious HTML and JavaScript by providing a craftied theme value via customer_index.php . The payload executes in an administrator's browser when they view the cust...

CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...

Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098

Magnolia CMS = 6.2.19 Stored Cross Site Scripting CVE-2022-33098 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in Magnolia CMS 6.2.19...

WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Link Whisper Free versions = 0.9.7...

CVE-2025-12101-checker

CVE-2025-12101-checker Simple Python PoC to check Citrix NetScaler ADC / Gateway instances for CVE-2025-12101 reflected XSS on /cgi/logout using a crafted SAMLResponse + RelayState payload. ⚠️ Use this tool only on systems you own or are explicitly authorized to test. 🔍 Background CVE-2025-12101...

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pr0f in WordPress Plugin User Registration versions = 5.2.8...

WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Prakrit in WordPress Plugin Social Share Buttons versions = 1.31...

WordPress Booking Package plugin <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Booking Package versions = 1.7.29...

CVE-2024-4367-PDF.js-xss

CVE-2024-4367–PDF.js-xss CVE-2024-4367–PDF.js-xss Download the environment, unzip it, and enter unzip cve-2024-4367-lab cd cve-2024-4367-lab Environment startup command mkdir upload chmod 777 upload docker-compose up -d...

WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Everest Forms versions = 3.6.1...