Roundcube-CVE-2024-42008-POC

CVE-2024-42008 RoundCube XSS Exploit Resumen Este repositorio contiene una prueba de concepto del exploit para CVE-2024-42008 , una vulnerabilidad de Cross-Site Scripting XSS en la aplicación webmail RoundCube. Este exploit está diseñado con fines educativos y para entornos de pruebas de...

PasteJacker

PasteJacker 该工具的主要目的是自动化（PasteJacking/剪贴板投毒/随便你怎么称呼）攻击，将所有已知的攻击技巧集中在一个地方，并自动化执行。因为在搜索后，我发现没有工具能以正确的方式做到这一点 😄 由于这种攻击取决于用户将要粘贴的内容，我将Metasploit的web-delivery模块的想法实现到了工具中。因此，当用户粘贴到终端时，你就能在他的设备上获得meterpreter会话 😄 在YouTube上观看教程 什么是PasteJacking？ 简而言之，Pastejacking是一种恶意网站用来控制你电脑剪贴板并在你不知情的情况下将其内容更改为有害内容的方法。...

CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF to RCE in WordPress Custom CSS, JS & PHP plugin = 2.4.1 🧠 Description A Cross-Site Request Forgery CSRF vulnerability in the WPFactory Custom CSS, JS & PHP plugin allows for Remote Code Execution RCE by injecting malicious PHP code via unauthorized POST requests. This...

CVE-2026-42897

CVE-2026-42897 - Punto ciego de la regla de reescritura saliente del Exchange Health Checker Severidad: Media CVSS 5.3 Componente: Microsoft CSS-Exchange - herramienta de diagnóstico HealthChecker Archivos afectados: Diagnostics/HealthChecker/Analyzer/Get-URLRewriteRule.ps1 L49, L72, L97...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

EUVD-2026-72874

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738

Snipe-IT versions before 8.7.0 are affected by a CSS injection vulnerability in the Custom CSS field . The root cause is incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. A superuser can plant malicious CSS payloads using @import and url() references...

wordreaper

Acerca del Proyecto Esta herramienta está diseñada para extraer y generar listas de palabras inteligentes y enfocadas para un potente cracking de contraseñas, utilizando selectores CSS con precisión quirúrgica. Visión general de características Extracción HTML Extrae texto usando selectores CSS...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — PoC de XSS almacenado en Roundcube Webmail 1.6.6 Solo para pruebas de seguridad autorizadas, entornos CTF e investigación educativa. Usar esta herramienta contra sistemas que no posees o para los que no tienes permiso por escrito es ilegal según la Computer Misuse Act 1990 Reino...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Exploit PoC de Dompdf RCE alt text ExploitDB Las versiones de Dompdf 1.2.1 son vulnerables a Ejecución Remota de Código RCE mediante la inyección de CSS en los datos. Se puede engañar al archivo para que almacene una fuente maliciosa con extensión .php en su caché de...

CVE-2020-13756-env

CVE-2020-13756 Entorno Vulnerable Entorno de prueba vulnerable para CVE-2020-13756 - Ejecución Remota de Código en el Analizador CSS PHP de Sabberworm. Detalles de la Vulnerabilidad...

CVE-2023-49103

CVE-2023-49103 PoC for the CVE-2023-49103 Overview This Python script is designed to efficiently process a large list of URLs to check for the presence of phpinfo output. It uses multi-threading to handle a large number of URLs concurrently, significantly speeding up the process. The script also...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval, letting unauthenticated attackers execute arbitrary PHP code on the server. id: CVE-2026-6433 info: name: FlipperCode Custom CSS, JS & PHP = 2.0.7 -...

CVE-2026-2441

CVE-2026-2441 — Chrome CSSFontFeatureValuesMap Use-After-Free CVSS 8.8 High | Actively Exploited in the Wild | Renderer RCE Sandboxed A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted...

CVE-2026-59941

CVE-2026-59942: Dompdf Resource Exhaustion DoS - Proof of Concept Vulnerability Type: Denial of Service DoS via Resource Exhaustion Affected Software: Dompdf = 3.1.5 Credits: Fabian Rosales far00t01. Disclaimer This repository and its content are provided for educational and research purposes onl...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 This proof of concept PoC demonstrates the exploitation of two vulnerabilities in Roundcube Webmail that enable CSS injection and a cross-site scripting XSS. The attack consists of two stages: 1. XSS via malicious XML attachment CVE-2024-42008...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

CSS-Keylogging

CSS 键盘记录器 利用 CSS 键盘记录功能的 Chrome 扩展和 Express 服务器。 使用方法 设置 Chrome 扩展 1. 下载仓库 git clone https://github.com/maxchehab/CSS-Keylogging 2. 在浏览器中访问 chrome://extensions（或点击 Chrome 菜单最右侧的三横图标，选择“更多工具”下的“扩展程序”）。 3. 确保右上角的“开发者模式”复选框已勾选。 4. 点击“加载已解压的扩展程序”，弹出文件选择对话框。 5. 选择你下载仓库目录中的 css-keylogger-extension 文件夹。...