CVE-2022-43271

CVE-2022-43271 저장된 크로스 사이트 스크립팅 XSS 제품: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software 발견 날짜: 2/8/2022 수정 날짜: 4/8/2022 영향 받는 버전: 버전 4, 빌드 260 수정된 버전: 버전 4, 빌드 261 설명: 이 취약점은 CRM의 '직원 설정' 중 '프로필' 텍스트 상자에서 발견되었습니다. 변경 사항을 저장하고 POST 요청을 가로챌 때 'lProfileCopy' 매개변수를 수정하여 XSS 페이로드를 포함시키고...

java-html-sanitizer

OWASP Java HTML Sanitizer Java로 작성된 빠르고 구성하기 쉬운 HTML Sanitizer로, XSS를 방지하면서 제3자가 작성한 HTML을 웹 애플리케이션에 포함할 수 있게 해 줍니다. 기존 의존성은 JSR 305입니다. 다른 jar 파일들은 테스트 스위트에만 필요합니다. JSR 305 의존성은 컴파일 전용 의존성으로, 어노테이션에만 필요합니다. 이 코드는 보안 모범 사례를 염두에 두고 작성되었으며, 광범위한 테스트 스위트를 갖추고 있고 적대적 보안 검토를 거쳤습니다. 목차 시작하기 사전 패키징된 정책 ...

EUVD-2026-82792

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-83561

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.4 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the Elementor Cookie Blocker Regex, caused by insufficient input sanitization and output escaping. An attacker can inject arbit...

CVE-2026-83561 Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-13533 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

EUVD-2025-210931

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, a...

CVE-2025-13533

The CSS & JavaScript Toolbox WordPress plugin (all versions up to and including 12.0.6 ) is vulnerable to Stored Cross-Site Scripting via the Assignment Engine fields. The root cause is insufficient input sanitization and output escaping on assignment data fields including Expressions , URLs , an...

CVE-2026-40534

CVE-2026-40534 is a cross-site scripting (XSS) vulnerability in the Video API component of Synology DiskStation Manager (DSM) , caused by improper neutralization of input during web page generation. Remote authenticated users can read or write limited files when the media player is launched. Affe...

CVE-2026-40534

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - "firstname" 필드/매개변수의 Cross-Site Scripting XSS 취약점 "customerlist" 페이지 설명 : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 공격자는 고객 편집/생성 시 "firstname" 필드/매개변수를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는...

CVE-2023-43770-POC

CVE-2023-43770 POC 최근 발견된 CVE-2023-43770 취약점에 대한 개념 증명Proof-of-Concept입니다. 1.4.14 이전의 Roundcube, 1.5.4 이전의 1.5.x, 1.6.3 이전의 1.6.x 버전은 program/lib/Roundcube/rcubestringreplacer.php의 동작으로 인해 조작된 링크가 포함된 text/plain 이메일 메시지를 통한 XSS를 허용합니다. 사용법 root@kitploit: python cve-2023-43770.py -e...

CVE-2023-45992

CVE-2023-45992 Ruckus CloudPath 5.12 build 5538 이하의 취약점으로 인해 원격의 인증되지 않은 공격자가 Stored Cross-Site Scripting 및 Cross-Site Request Forgery 취약점을 악용하여 조작된 스크립트를 통해 전체 관리자 권한을 획득할 수 있습니다. 2023년 10월 16일, 공급업체는 이 취약점을 해결한 버전 5.12 build 5550을 출시했습니다. POC 취약점의 기술적 세부 사항은 향후 공개될 예정입니다. References...

EUVD-2026-82780

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-13623

CVE-2026-13623 is a cross-site scripting (XSS) vulnerability in the Theme API of Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The improper neutralization of input during web page generation allows remote authenticate...

CVE-2025-25062

CVE-2025-25062 설명 사용법 예제 타임라인 설명 Backdrop CMS 1.29.2의 게시물 편집 페이지에 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 이 스크립트는 CSRF 페이로드와 연계하여 '편집자' 역할에서 '관리자'로 권한 상승을 달성합니다. 관련 링크: https://vulners.com/cve/CVE-2025-25062 https://backdropcms.org/security/backdrop-sa-core-2025-001 사용법 root@kitploit: usage:...

CVE-2019-16172

CVE-2019-16172 CVE-2019-16172スキャナーは、LimeSurveyインスタンスに保存型XSS脆弱性が存在するかどうかをチェックするために設計されています。 CVE説明 CVE-2019-16172 説明:...

CVE-2026-92249

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2026-92554

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...