CVE-2024-6651

CVE-2024-6651 POC XSS - CVE-2024-6651 Functional PoC for vulnerability CVE-2024-6651, which affects the plugin WP File Upload 4.24.8, allowing Reflected Cross-Site Scripting XSS in WordPress. 📌 Description This vulnerability allows arbitrary JavaScript code injection via an unsanitized parameter ...

CVE-2020-25627

CVE-2020-25627 用户资料中的moodlenetprofile参数存储型XSS 关于此CVE的PoC 用户要求：学生（或者注册网站） moodlenetprofile中的XSS root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new user without assigning roles Step 2: Quick access to Edit profile...

DWrwq

Descrip PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php. Vulnerability Overview 1.Vulnerability Type: Stored Cross-Site Scripting XSS 2.Affected Product: Online Shopping Portal Project - 2.1 3.Affected Component:...

XanXSS

XanXSS XanXSS 是一款反射型 XSS 搜索工具（DOM 版本即将推出），它能基于模板生成 payload。与其他仅仅遍历 payload 列表的 XSS 扫描器不同，XanXSS 会努力让 payload 变得难以识别，例如： root@kitploit: /cLIcKMe!XaNxss 使用 XanXSS，每个 payload 都各不相同。XanXSS 的工作原理是遍历 payload，直到找到指定数量的有效 payload 或计时器达到最大时间，这可以避免无限循环。XanXSS 包含的一些功能： 使用 -H 传递自定义请求头 使用 -P 生成多语言脚本（polyglot）...

cve-2025-0133

Herramienta de Detección de XSS Reflejado CVE-2025-0133 Autor : Derek Odiorne Fecha : 2025-05-23 Severidad : Media Probado Contra : Portal GlobalProtect de Palo Alto Networks PAN-OS 📌 Resumen Este script realiza pruebas seguras y autorizadas para la vulnerabilidad CVE-2025-0133 , un problema de...

AwesomeXSS

AwesomeXSS This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue. Awesome contents Challenges Reads & Presentations Tools Mind maps DOM XSS Payloads Polyglots Tags and event handlers Context breaking HTML context Attribute context...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

CVE-2024-41312.

CVE-2024-41312. InstantCMS - Cross Site Scripting Almacenado XSS Versión afectada: InstantCMS 2.16.3 Pasos para reproducir: 1. Inicia sesión en https://demo.instantcms.io como un usuario demo. 2. Visita https://demo.instantcms.io/photos/upload. 3. Carga la imagen con el payload incrustado de prue...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

CVE-2022-31298

CVE-2022-31298 Haraj Script 3.7 - 认证存储型XSS 漏洞标题：Haraj Script 3.7 - 认证存储型XSS 日期：2022-06-13 CVE编号：CVE-2022-31298 漏洞作者：Abdulaziz Saad @b4zb0z 厂商主页：https://angtech.org/ 软件链接：https://angtech.org/product/view/3 版本：3.7 测试环境：LAMP, Ubuntu 利用 ： 直接在广告评论区使用js载荷进行利用...

awesome-oneliner-bugbounty

Awesome One-liner Bug Bounty A collection of awesome one-liner scripts especially for bug bounty. This repository stores and houses various one-liner for bug bounty tips provided by me as well as contributed by the community. Your contributions and suggestions are heartily♥ welcome. Definitions...

dorkX

dorkX Conecta diferentes herramientas con el escáner de Google Dorks Versión 1.0 Instalación zoid@MSI /dorkX git clone https://github.com/ethicalhackingplayground/dorkX zoid@MSI /dorkX cd dorkX zoid@MSI /dorkX go build dorkx.go zoid@MSI /dorkX go build corsx.go zoid@MSI /dorkX go build csrfx.go...

CVE-2024-27665

CVE-2024-27665 Unifiedtransform v2.X 存在存储型跨站脚本攻击（XSS）漏洞，通过课程大纲模块的文件上传功能利用。 供应商：https://github.com/changeweb/Unifiedtransform PoC 步骤 1：登录应用程序并导航到学术模块。 步骤 2：从学术模块使用随机数据创建学期、学年、班级、课程。 步骤 3：导航到课程大纲模块，填写所需详细信息，并在课程大纲文件上传输入中上传包含 XSS 载荷的 PDF 文件。 步骤 4：导航到班级 - 课程大纲并点击下载。 步骤 5：观察 XSS 被触发！...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

CVE-2021-38603

CVE-2021-38603 Una vulnerabilidad de Cross-Site Scripting almacenado está presente en la página de edición de perfil en el campo Información: para cada usuario. http:///core/admin/profil.php Campos Vulnerables: Información: Una vez insertado, el XSS se puede activar visitando cualquier...

PT-2026-90839

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

EUVD-2025-210894

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2025-64059

Grav 1.7.50.2 allows administrators to inject JavaScript through the Home Page editor , a potential stored XSS vector. However, the practical relevance is disputed : since admins already possess the ability to modify templates, install plugins, and upload other executable content, the additional ...

PT-2026-90832

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

CVE-2025-63842

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...