Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST emailcreate and back parameter. id: CVE-2023-36289 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author:...

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

MyCryptoCheckout < 2.124 - Cross-Site Scripting

The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. id: CVE-2023-1546 info: name: MyCryptoCheckout 2.124 - Cross-Site Scripting author: Harsh severity: medium description: | The...

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. id: CVE-2023-49489 info: name: KodeExplorer 4.51 - Reflective Cross Site Scripting XSS...

PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2. id: CVE-2023-40753 info: name: PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site...

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress GN Publisher <1.5.6 - Cross-Site Scripting

WordPress GN Publisher plugin before 1.5.6 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting

WPZOOM Portfolio = 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request. id: CVE-2026-49069 info: name: WPZOOM Portfolio = 1.4.21 - Reflected Cross-Site...

WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting

WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevartduplicatepostparametrssaveindb AJAX action, allowing unauthenticated users to call...

JSShell

JSShell 2.0 صدفة جافا سكريبت تفاعلية متعددة المستخدمين تعتمد على الويب. تم إنشاؤها في البداية لتصحيح المتصفحات البعيدة غير التقليدية أثناء التجارب والأبحاث. يمكن ربط هذه الأداة بسهولة بحمولة XSS البرمجة النصية عبر المواقع لتحقيق تنفيذ تعليمات برمجية عن بُعد في المتصفح على غرار إطار عمل BeeF. تم...

CVE-2019-18426

Divulgation de vulnérabilités WhatsApp - Redirection ouverte + Contournement CSP + XSS persistante + permissions de lecture FS + potentiel de RCE CVE-2019-18426 Article technique Documents originaux de divulgation des vulnérabilités Vidéos de démonstration !...

CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5

CVE-2023-34537--- XSS réfléchi trouvé dans HotelDruid V3.0.5 HotelDruid v3.0.5 est vulnérable à de multiples vulnérabilités XSS. Ces vulnérabilités pourraient permettre à des attaquants authentifiés à distance d'injecter du script web ou du HTML arbitraire. C'est mon troisième repo. Ne me frappez...

CVE-2026-15253

CVE-2026-15253 Easy Media Replace = 0.2.0 - Cross-Site Scripting stocké authentifié Auteur+ Description Le plugin Easy Media Replace est vulnérable à un Cross-Site Scripting stocké XSS via le titre de la pièce jointe média. Lorsqu'un Auteur renomme un fichier média en utilisant une charge utile X...

CVE-2023-45542

CVE-2023-45542 Une vulnérabilité de cross-site scripting XSS réfléchi existe dans le paramètre q de la fonction de recherche de mooSocial v3.1.8, permettant à des attaquants de voler les cookies de session des utilisateurs et d'usurper leur compte via une URL spécialement conçue. Paramètre...

sslscan

sslscan2 sslscan version 2 has now been released. This includes a major rewrite of the backend scanning code, which means that it is no longer reliant on the version of OpenSSL for many checks. This means that it is possible to support legacy protocols SSLv2 and SSLv3, as well as supporting TLSv1...

bugbounty_tools

bugbountytools Collection de scripts et d'outils utilisés lors de travaux de bug bounty. Ce sera l'emplacement de mes scripts d'automatisation créés pour mon usage personnel, et parfois publiés. Contact: Pour toute question, commentaire ou demande, faites un post sur mon compte X pas en DM et je...