CVE-2019-12475

CVE-2019-12475 Stored XSS in MicroStrategy Web prior to 10.4.6 Author: undefinedmode https://github.com/undefinedmode/CVE-2019-12453 Stored XSS in metric and it is triggered when opening the Visual Threshold editor. Reported to vendor in 2017 and fixed quickly in version 10.4.6...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4439...

CVE-2022-35500

CVE-2022-35500 Stored Cross-site Scripting XSS in leave comment functionality in Amasty Blog Pro for Magento 2 Description The leave comment functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the AmBlogLeaveComment mutation in name...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...

dalfox

¿Buscas la versión Go v2.x? Dalfox v3 es una reescritura completa en Rust. El código base de Go se conserva en la rama v2 y continúa recibiendo backports de seguridad. Consulta SECURITY.md para conocer la política de soporte y la guía de migración para ver qué cambió en v3. Dalfox es una potente...

CSZ-CMS-Stored-XSS---Site-Settings

CSZ CMS Stored XSS v1.3.0 Author: Sergio Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Site Settings Menu. Attack Vectors: Scripting A vulnerability in the...

XSS2Shell

XSS2Shell XSS2Shell is an educational proof of concept for CVE-2026-64638 , demonstrating the impact of a pre-authentication XSS issue in vulnerable WordPress installations. With an administrator's explicit participation, the PoC captures a WordPress Application Password, publishes a temporary...

ppmap

ppmap 一款用 GO 编写的简单扫描/利用工具，能够自动利用已知的现有 gadgets（检查全局上下文中的特定变量），通过原型污染执行 XSS。注意：该程序仅利用已知 gadgets，不涵盖代码分析或任何高级原型污染利用（可能包含自定义 gadgets）。 环境要求 确保已安装 Chromium。无需担心，setup.sh 会自动为你安装。 安装 运行以下命令克隆仓库： root@kitploit: git clone https://github.com/kleiton0x00/ppmap.git 切换到 ppmap 目录并执行 setup.sh ： root@kitploit: ...

ppmap

ppmap A simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets checks for specific variables in the global context to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advance...

Metadata-Attacker

Metadata-Attacker With this small suite of open source pentesting tools you're able to create an image .jpg, audio .mp3 or video .mp4 file containing your custom metadata or a set of cross-site scripting vectors to test any webservice against possible XSS vulnerabilities when displaying unfiltere...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter. PoC: to exploit it only...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

BurpSentinel

Burp Sentinel Eases discovery of common security holes in web applications. Intro / tutorial: https://github.com/dobin/BurpSentinel/wiki/BurpSentinel---HowTo-and-introduction Blog: http://dobin.github.io/ With BurpSentinel it is possible for the penetration tester to quickly and easily send a lot...

XSScope

Go beyond the alert XSScope is one of the most advanced GUI Framework for XSS Clientside attacks. It can perform different XSS attack and HTML Injection in real time. Features Perform XSS botnet attacks. Every victim who is affected by XSS payload in the webserver, will contantly bind the payload...

xssmap

2020.08.20 update 小 bug 还比较多，最近会抽时间来修改，请保持 update XSSMAP 检测Web应用程序中的XSS漏洞 交互模块参考自 sqlmap，如果你熟悉 sqlmap，那么一定可以轻松上手 xssmap！ 英文介绍 截图...

XanXSS

XanXSS XanXSS is a reflected XSS searching tool DOM coming soon that creates payloads based from templates. Unlike other XSS scanners that just run through a list of payloads. XanXSS tries to make the payload unidentifiable, for example: root@kitploit: /cLIcKMe!XaNxss With XanXSS every payload is...

CVE-2021-31761

CVE-2021-31761 Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Remote Command Execution RCE through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Remote Command Execution eXploit's...

gitleaks

Gitleaks root@kitploit: ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only. I'm shifting my focus to Betterleaks...

JSShell

JSShell 2.0 An interactive multi-user web based javascript shell. It was initially created in order to debug remote esoteric browsers during experiments and research. This tool can be easily attached to XSS Cross Site Scripting payload to achieve browser remote code execution similar to the BeeF...

CVE-2024-27665

CVE-2024-27665 Unifiedtransform v2.X 存在存储型跨站脚本攻击（XSS）漏洞，通过课程大纲模块的文件上传功能利用。 供应商：https://github.com/changeweb/Unifiedtransform PoC 步骤 1：登录应用程序并导航到学术模块。 步骤 2：从学术模块使用随机数据创建学期、学年、班级、课程。 步骤 3：导航到课程大纲模块，填写所需详细信息，并在课程大纲文件上传输入中上传包含 XSS 载荷的 PDF 文件。 步骤 4：导航到班级 - 课程大纲并点击下载。 步骤 5：观察 XSS 被触发！...