JSONBee

JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...

loxs-optimized

loxs-optimized Proyecto de https://github.com/coffinxp/loxs CSP-Bypass-xss.txt Nota: Principalmente elude el payload de CSP 2024-11-06 Añade CSP-Bypass-xss.txt a xss.txt 2024-11-07 Eliminando información que interfiere Solo se muestra la información vulnerable 2024-11-11 Resuelve el problema de q...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads ... -- " !-- If number of iframes on the pa...

pixload

pixload -- Image Payload Creating tools DESCRIPTION Set of tools for hiding backdoors creating/injecting payload into images. The following image types are currently supported: BMP, GIF, JPG, PNG, WebP. about Useful references for better understanding of pixload and its use-cases: Bypassing CSP...

CSPBypass

CSP Bypass Bienvenido a CSPBypass.com , una herramienta diseñada para ayudar a los hackers éticos a eludir Políticas de Seguridad de Contenido CSP restrictivas y explotar vulnerabilidades XSS Cross-Site Scripting en sitios donde las inyecciones están bloqueadas por CSP que solo permiten ciertos...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Vulnerabilidad de evasión de middleware en Next.js Este repositorio demuestra la vulnerabilidad CVE-2025-29927 en Next.js, donde el encabezado interno x-middleware-subrequest puede utilizarse para evadir comprobaciones de middleware como la autenticación. Versiones...

nextjs-middleware-exploit

Investigación de vulnerabilidad en middleware de Next.js CVE-2025-29927 Este repositorio demuestra una vulnerabilidad crítica en el middleware de Next.js CVE-2025-29927, que afecta a las versiones 11.1.4 hasta 15.1.7. Esta vulnerabilidad permite el bypass de autorización , el bypass de CSP y...

POC-CVE-2025-29927

CVE-2025-29927: Next.js 中间件绕过 PoC 概述 该 PoC 演示了 CVE-2025-29927，这是 Next.js 中间件中的一个漏洞，攻击者可以利用 x-middleware-subrequest 头部绕过身份验证、授权和 CSP 机制。 受影响版本 Next.js 版本 11.1.4 至 15.1.7 设置与安装 1️⃣ 克隆并安装 PoC git clone https://github.com/Eve-SatOrU/POC-CVE-2025-29927.git cd POC-CVE-2025-29927 cd Demo cd my-next-app...

next.js_cve-2025-29927

next.jscve-2025-29927 A small and simple Next.js application running version 14.2.24 used to test CVE-2025-29927. Access the admin area /admin by utilizing the vulnerability or the hardcoded credentials admin:admin. » git clone [email protected]:0xPThree/next.jscve-2025-29927.git » docker...

CVE-2019-18426

WhatsApp漏洞披露 - 开放重定向 + CSP绕过 + 持久性XSS + 文件系统读取权限 + 潜在远程代码执行 CVE-2019-18426 技术文章 原始漏洞披露文档 演示视频！...

CVE-2020-6519

Esto fue publicado originalmente en el Github oficial de la empresa PerimeterX a través de mi cuenta de Github de trabajo. Aunque este es mi trabajo - todos los derechos y asuntos legales pertenecen a la empresa PerimeterX. Chromium 83 Zero Day: Bypass Completo de CSP Multiplataforma CVE-2020-651...

CVE-2019-18426

Esto fue publicado originalmente en el Github oficial de la empresa PerimeterX a través de mi cuenta de Github de trabajo. Aunque este es mi trabajo, todos los derechos y asuntos legales pertenecen a la empresa PerimeterX. Divulgación de vulnerabilidades de WhatsApp - Open Redirect + Bypass de CS...

CVE-2020-6519

Chromium 83 Día Cero Bypass Completo de CSP Multiplataforma CVE-2020-6519 Artículo técnico POC tal como fue reportado al proyecto Chromium ¡Videos demo!...

Astra Linux – Vulnerability in Firefox

Because Firefox did not implement the unsafe-hashes CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy might have been able to inject executable scripts. This would be severely restricted by the specified Content Security Policy o...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Content Security Policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in Action Pack versions = 5.2.0 and 5.2.0, which could allow an attacker to bypass the Content Security Policy and generate non-HTML responses...

CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Summary Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces ...

EUVD-2026-68328

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...