CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2026-116802

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS. When configured to parse Extensible Hypertext Markup Language XHTML content, the library fails to properly normalize and sanitize attribute names within animation elements. An attacker...

manim-cranim

cranim Manim toolkit for cryptographic scenes. Check out the example gallery: https://nccgroup.github.io/manim-cranim/ Local install: From the repo's root directory, run pip install -e . or pip install . if you don't expect to ever make local changes. This is a Manim plugin. Manim requires plugin...

Firefox-CVE-2024-9680

Firefox CVE-2024-9680 CVE-2024-9680 Description An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox 131.0.2, Firefox E...

Tor-0day-JavaScript-Exploit

CVE-2024-9680 - TOR Browser 0day Exploit UAF Use-After-Free in Animation Timelines - Remote Code Execution Vulnerability Actively exploited in the wild targeting Tor Browser users View Analysis • Official CVE Overview This repository contains a comprehensive analysis and educational demonstration...

CVE-2024-37383-exploit

Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...

firefox-rce-nssmil

Firefox RCE CVE-2016-9079 – Educational JavaScript Port Educational implementation of the public exploit for CVE-2016-9079, adapted from the original Exploit-DB/Metasploit module for standalone use. Disclaimer This repository is provided strictly for educational and research purposes. It contains...

printer-cracktro

printer cracktro My Pwn2Own entries for Pwn2Own Toronto 2022 targeted two different printers. One is Linux based Lexmark and other is DryOS based CANON. After pwning the software on the printer the entries would display a little oldschool crack-intro animation thing to celebrate/illustrate the...

CVE-2025-1639

🔓 Exploit Script for CVE-2025-1639 📝 Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...

CVE-2026-110018

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists...

EUVD-2026-109265

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists...

CVE-2026-113128

A flaw was found in chromium-browser. Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy by convincing a victim to visit a crafted HTML page. Successful exploitation could lead to information disclosure by allowing an unauthorized website to...

CVE-2026-114127

The Astro web framework (versions 7.1.0 to 7.3.3 ) is vulnerable to arbitrary CSS injection within its server-side View Transition CSS generator. The root cause is the failure to keep string animation properties (such as duration , delay , easing , direction , fillMode , or animation names ) with...

CVE-2026-114127 Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, dela...

CVE-2026-114127 Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, dela...

SUSE CVE-2026-112995

Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113128

Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-112995

A flaw was found in the Animation component of Chromium. This use-after-free issue occurs when the application attempts to access memory after it has been freed. A remote attacker could exploit this vulnerability by convincing a user to open a specially crafted HTML page, potentially leading to...

EUVD-2026-105601

Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-105566

Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...