Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Prueba de concepto: CVE-2024-42008 y CVE-2024-42010 Esta prueba de concepto PoC demuestra la explotación de dos vulnerabilidades en Roundcube Webmail que permiten la inyección de CSS y un cross-site scripting XSS. El ataque consta de dos etapas: 1. XSS mediante archivo adjunto XML malicioso...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC 漏洞利用 图片 ExploitDB Dompdf 版本 1.2.1 存在远程代码执行（RCE）漏洞，攻击方式是在数据中注入 CSS。可以诱骗该文件在其字体缓存中存储带有 .php 文件扩展名的恶意字体，之后通过 Web 访问该字体即可执行代码。 用法 root@kitploit: git clone https://github.com/rvizx/CVE-2022-28368 cd CVE-2022-28368 python3 -m pip install -r requirements.txt...

CVE-2026-19698

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-19698 GutenKit < 2.5.1 - Contributor+ Stored CSS Injection

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

EUVD-2026-70036

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-19698 GutenKit < 2.5.1 - Contributor+ Stored CSS Injection

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-19698

CVE-2026-19698 affects the GutenKit WordPress plugin in versions before 2.5.1 . The root cause is the absence of validation or escaping on style settings saved against a post before they are used to build the CSS output on the front end. This allows users with the Contributor role or above to inj...

EUVD-2026-43003

Snipe-IT has CSS Injection via headercolor Setting...

Chromium: CVE-2026-79234 Injection in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-79234

A flaw was found in Google Chrome. This injection vulnerability in CSS allows a remote attacker to potentially obtain sensitive information by enticing a user to visit a specially crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-79234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium...

PT-2026-82332

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when custom font family names are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. The backend accepts an arbitrary...

DEBIAN-CVE-2026-79234

Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79234

Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79234

Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79234

CVE-2026-79234 is a CSS injection vulnerability in Google Chrome prior to version 152.0.7977.65 , rated Medium severity (CVSS 6.5). A remote attacker can obtain sensitive information by enticing a user to visit a specially crafted HTML page. The attack requires user interaction (visiting the page...

CVE-2026-79234

Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79234

Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-81794

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An injection flaw in CSS allows a remote attacker to potentially obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google Chrome to...