XSS-PoCs

XSS-PoCs Cross-Site Scripting Proof of Concepts...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

BrokenHill

!\ Broken Hill logo \https://assets.kitploit.com/production/public/readmes/44608/c14154675c6f33f5c3887887afcdb39351c82f269ee2772cf31847106a20a871.jpg Broken Hill Broken Hill is a productionized, ready-to-use automated attack tool that generates crafted prompts to bypass restrictions in large...

CVE-2026-27621

CVE-2026-27621: TypiCMS Core has Stored Cross-Site Scripting XSS via SVG File Upload Overview Field| Details ---|--- CVE ID| CVE-2026-27621 Severity| MEDIUM Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products typicms/core versions: 16.1.7 CWE Classification CWE-79: Improper...

LInux-Kernel-InfoLeak-6.12.-Leveraged-to-do-cross-container-info-leak.-

LInux-Kernel-InfoLeak-6.12.-Leveraged-to-do-cross-container-info-leak.- POC shows how to leak postgresql stuff cause hugefile sub-system. Based on https://x.com/spendergrsec/status/1993794163880718700?s=20...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107397

The event management system Indico is vulnerable to a Cross-Site Scripting (XSS) flaw in its minutes editor prior to version 3.3.13 . The root cause is that users with content creation privileges, such as speakers, can store crafted HTML within event minutes. When concurrent edits occur on the sa...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107396 Indico: Cross-Site-Scripting in link fields

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user...

inference-gateway-PoC

inference-gateway: security advisory | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440 Advisory| GHSA-5293-fcm6-fh8v CVE| CVE-2026-87009 CVSS 3.1| 5.4 Medium — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Weakness| CWE-352, CWE-306, CWE-346 Status| Fixed in v0.46.0 Summary : inference-gatew...

fudcrypt

fudcrypt Python3 Based Obfuscator That Can bypass any antivirus easily. Important: 1. Make Sure your payload file have all the libraries import and it will be a valid payload file 2. If Your Payload get detected then let me know i will update the stub. 3. If u need cobalt strike evasions then DM ...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS Misconfiguration + CSRF Protection Bypass Combined Attack Summary A critical combined attack vulnerability exists in Halo CMS versions up to 2.25.4 due to two security misconfigurations: 1. CORS Misconfiguration : The CORS policy allows any origin with credentials:...

AIDebug

AIDebug Reviewer starting point Evidence-focused reverse-engineering CLI. Andrey Pautov develops the Python analyst interface, offline triage, string intelligence, PE inspection and reporting workflows. Capstone, Ghidra, GDB and optional AI providers are integrations, not original tools authored ...

CVE-2026-88648

Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates...

HIROO

HIROO HIROO is an FUD Remote Administration Tool RAT Generator and Controller HOW TO USE its really easy to use just do this in your terminal git clone https://github.com/E-RROR/HIROO cd HIROO python HIROO.py RUN ON WINDOWS the shell output will be python format you can make it .exe file with...

CVE-2026-40804

The aBlocks WordPress plugin (versions

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.20.41 security update

Red Hat build of MicroShift release 4.20.41 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2024-39123-Exploit

CVE-2024-39123: Stored XSS in Calibre-web 0.6.21 Exploit Details Exploit Title : Stored XSS in Calibre-web Date : 2024-05-07 Exploit Authors : Catalin Iovita & Alexandru Postolache Pentest-Tools.com Vendor Homepage : Calibre-web GitHub Repository Version : 0.6.21 - Romesa Tested on : Linux...

CVE-2026-34200

Nhost MCP Server: One-Click Infrastructure Compromise Official Advisory: This vulnerability was acknowledged and published by Nhost: GHSA-6c5x-3h35-vvw2 This repository documents a vulnerability in the Nhost Local MCP Server. The service lacks inbound authentication and implements a permissive CO...