Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 この概念実証（PoC）は、CSSインジェクションとクロスサイトスクリプティング（XSS）を可能にする、Roundcube Webmail の2つの脆弱性の悪用を実証します。攻撃は2つの段階で構成されます: 1. 悪意のあるXML添付ファイルによるXSS（CVE-2024-42008） ファイルアップロードのチェックが不十分なため、JavaScriptコードを含むXMLファイルを添付ファイルとして送信できます。例: root@kitploit: " alertorigin...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC エクスプロイト alt text ExploitDB Dompdf バージョン 1.2.1 未満は、データに CSS を注入することでリモートコード実行（RCE）の脆弱性があります。Dompdf は、フォントキャッシュに .php ファイル拡張子を持つ悪意のあるフォントを保存するよう欺かれる可能性があり、そのファイルは後で Web からアクセスすることで実行される可能性があります。 使用方法 root@kitploit: git clone...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - Roundcube Webmail における格納型XSS、HTMLインジェクション、CSSインジェクション 概要 このリポジトリは、Roundcube Webmail における格納型クロスサイトスクリプティング（XSS）、HTMLインジェクション、CSSインジェクションの脆弱性 CVE-2026-48849 の概念実証（PoC）を含んでいます。...

CVE-2026-85271

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271

Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

EUVD-2026-83443

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC

Description WordPress does not properly enforce the capability required to edit custom CSS when publishing customizer changes through XML-RPC in some cases, which could allow site administrators on Multisite, who are denied that capability, to inject arbitrary CSS into the site...

GHSA-FFMG-HFVG-JHG9 Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

CVE-2026-18119

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have injected CSS into stylesheets that are accessible via internal URIs, such as resource:, thereby bypassing a page’s Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738

Snipe-IT versions before 8.7.0 are affected by a CSS injection vulnerability in the Custom CSS field . The root cause is incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. A superuser can plant malicious CSS payloads using @import and url() references...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...