90 matches found
Limbas-4.3.36.1319-is-vulnerable-to-Cross-Site-Scripting-XSS-
Limbas-4.3.36.1319는 Cross-Site ScriptingXSS에 취약함 설명 Limbas 4.3.36.1319는 Cross-Site ScriptingXSS에 취약합니다. LIMBAS http://www.limbas.org/ - 4.3.36.1319 개념 증명 UPDATE/up20.php 페이지가 XSS 코드로 반사됨 예시 페이로드 1'"&% XSS 상세 내용 Cross-site ScriptingXSS은 공격자가 합법적인 웹사이트나 웹 애플리케이션에 악성 스크립트를 실행할 수 있는 클라이언트 측 코드 삽입 공격을...
CVE-2022-31297
CVE-2022-31297 Haraj Script 3.7 - 反射型XSS エクスプロイトタイトル: Haraj Script 3.7 - 反射型XSS 日付: 2022-06-13 CVE: CVE-2022-31297 エクスプロイト作者: Abdulaziz Saad @b4zb0z ベンダーホームページ: https://angtech.org/ ソフトウェアリンク: https://angtech.org/product/view/3 バージョン: 3.7 テスト環境: LAMP, Ubuntu...
EUVD-2025-210823
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...
CVE-2021-28378
CVE-2021-28378 이 CVE에 대한 자세한 내용은 여기에서 확인할 수 있습니다. 이 CVE는 서버에서 가져온 콘텐츠의 클라이언트 측에서 문자열 이스케이프가 누락된 것을 대상으로 합니다. 공격자가 이슈나 풀 리퀘스트에 댓글을 작성하여 쉽게 임의 코드를 주입할 수 있게 합니다. 이는 2020년 1월 말에 커밋 7d7ab1eeae43d99fe329878ac9c8db5e45e2dee5에서 도입되었지만, 스쿼시squash 때문에 정확히 누가 이 취약점을 도입했는지와 유사한 버그가 도입되었는지 조사할 수 없습니다. 먼저, 이...
PT-2026-81048
Name of the Vulnerable Software and Affected Versions Boost versions prior to 2.0.5 Description An unauthenticated Cross-Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the context of a user's session without requiring prior authentication. Recommendation...
CVE-2026-71286 ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input...
1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2153 more potentially affected by CVE-2026-65901 via dompurify (>=3.0.0, <=3.4.6)
dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-65901 Source advisory: OSV:GHSA-X4VX-RJVF-J5P4...
CVE-2026-45551 Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any userid via index.php?r=core/saveSetting. A separate client-side sink in the email module...
cross-site-scripting-lab
XSS Lab Documentation Overview What Is Cross-Site Scr...
CVE-2026-33061
CVE-2026-33061 affects Jexactyl (previously named Exactyl), a configurable game management panel and billing system. The issue arises from injecting server-side objects into client-side JavaScript via resources/views/templates/wrapper.blade.php, where unescaped {!! json_encode(...) !!} is used wi...
@deno/sandbox (>=0.0.9, <=0.6.0), @ekairos/dataset (>=1.21.56-beta.0, <=1.22.22-beta.development.0) +45 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.6.2)
devalue NPM version =5.0.0, =0.0.9, =1.21.56-beta.0, =1.22.4-beta.development.0, =1.21.56-beta.0, =1.21.67-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =2.3.65, =1.1.27, =1.1.21, =1.2.263, =2.2.3, =4.0.1 and...
CVE-2025-9292
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...
CVE-2025-9292
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...
CVE-2025-9292 Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...
CVE-2025-9292
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...
CVE-2025-9292
CVE-2025-9292 affects TP-Link Omada Cloud Controller. A permissive web security configuration may bypass cross-origin restrictions in certain conditions, enabling potential unauthorized disclosure of sensitive data. Exploitation requires an existing client-side injection vulnerability and access ...
PT-2026-7955
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...
Client-Side Content Injection (XSS)
dotnetnuke.core is vulnerable to Client-Side Content Injection XSS. The vulnerability is due to improper validation of query parameters, which allows an attacker to load and exploit vulnerable themes on client browsers without the site owner’s knowledge...