XSS-Catcher

XSS Catcher A blind XSS detection and XSS data capture framework that runs on Flask, VueJS and PostgreSQL. XSS Catcher is an intuitive tool that automates blind Cross-Site Scripting XSS attacks and data gathering, including screenshots. It features a user-friendly payload generator for creating...

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. ezXSS is a tool that is designed to help find and exploit cross-site scripting XSS vulnerabilities. One of the key features of ezXSS is its ability to identify and exploit blind XSS...

JSshell

JSshell - version 3.1 JSshell - a JavaScript reverse shell. This is used for executing JS code remotely, exploiting blind XSS, ... Requirements: Any OS + Python 2 or Python 3 New in JSshell version 3.1 Updated in the new version of JShell 3.1: New JSshell command: snippet - allows to write a...

B-XSSRF

B-XSSRF Toolkit to detect and keep track on Blind XSS, XXE & SSRF SETUP...

bxss

Bxss - Escáner de XSS Ciego 🚀 Descripción...

bxss

Bxss - Blind XSS Scanner 🚀 Description...

femida

Femida-xss（开发中） 一款用于 Burp Suite 的自动化盲 XSS 搜索插件。 安装 Git clone https://github.com/wish-i-was/femida.git Burp - Extender - Add - 找到并选择 blind-xss.py 使用方法 设置 首先，你需要在“Your url”字段中设置回调查询 URL，然后按 Enter 键自动将其保存到 config.py 文件中。 设置完成后，你需要在 Payloads 表格中填充 OOB-XSS 向量，这样插件就能将你的 payload 注入到发出的请求中。请注意，你需要在 paylo...

femida

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/wish-i-was/femida.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field called "Your url" and press Enter ...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

xsshunter-express

XSS Hunter Express Se configura en 5 minutos y no requiere mantenimiento La forma más rápida de configurar XSS Hunter para probar y encontrar vulnerabilidades de cross-site scripting ciego. Configuración Cinco minutos, intenta no saltarte demasiado Requisitos docker y docker-compose instalados Ho...

CVE-2025-50363_BXSS_CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Privilege Escalation via Blind XSS Affected Versions:v1.0 💣Vulnerability Description: A Blind Cross-Site Scripting XSS vulnerability was discovered in the Maid Hiring Management System, which allows a...

Blind-XSS-Manager

Blind-XSS-Manager Never forget where you inject. Description A Chrome extension that keeps track of the injected URL with Blind XSS payloads. It adds a unique value for each payload assigned to the URL and recorded by the extension when it gets coppied. The payloads are almost the same as the...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free Unauthenticated Stored Blind XSS Executive Summary This repository contains a local Docker lab for reproducing CVE-2025-11262 , an unauthenticated stored cross-site scripting issue affecting the WordPress plugin Link Whisper Free. The lab compares two plugin...

XSpear

XSpear XSpear is XSS Scanner on ruby gems !IMPORTANT XSpear Repository Archived This repository has been archived and is now read-only. XSpear is no longer actively maintained. Try Dalfox instead 🌙🦊 A faster, more powerful XSS scanner with advanced features. → https://github.com/hahwul/dalfox Key...

Automated-blind-xss-search-for-Burp-Suite

Femida-xss WIP Un plugin automatizado de búsqueda de blind-xss para Burp Suite. Instalación Git clone https://github.com/ianxtianxt/Automated-blind-xss-search-for-Burp-Suite.git Burp - Extender - Add - busca y selecciona blind-xss.py Cómo usar Configuración En primer lugar, debes configurar tu UR...

wraith

WRAITH — browser hook framework A modern, standalone browser-hooking framework for red teams, security researchers, and educators — a clean-room successor to BeEF and the blind-XSS callback tools we live in. FOR AUTHORIZED SECURITY TESTING, RESEARCH & EDUCATION ONLY. WRAITH is an offensive-securi...

XSSFire

XSSFire A standalone Blind XSS Script. How it works: The script is a combination between PHP and JavaScript, it captures the data using JS and send it to the script itself, then it generates report files and deliver them through telegram. Requirements: 1. Web Server running on Linux with a domain...

CVE-2026-34598 YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected...

CVE-2026-34598 YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected...

CVE-2026-34560

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged...