nanodump

NanoDump A flexible tool that creates a minidump of the LSASS process. Table of contents 1. Usage 2. Features 3. Combining Techniques 4. Examples 5. HTTPS Redirectors 1. Usage usage: Z:\nanodump.x64.exe --write C:\Windows\Temp\doc.docx --valid --duplicate --elevate-handle --duplicate-elevate...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle Once a victim clicks this link, evil.com will receive the cookies...

ChromeKatz

ChromeKatz ChromeKatz is a solution for dumping sensitive information from memory of Chromium based browsers. As for now, ChromeKatz consists of three projects: 1. CookieKatz - The cookie dumper 2. CredentialKatz - Deprecated.. for now 3. ElevationKatz - Get the decryption key from the elevation...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...

Bludit CMS <= 3.20.0 - Cross-Site Scripting

Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query. id: CVE-2026-41456 info: name: Bludit CMS = 3.20.0 - Cross-Site Scripting author: 0xAkoko...

TotalCMS-Arbitrary_File-Upload--XSS_Steal_Cookies---TotalDepot

TotalCMS Arbitrary File Upload - XSS and steal cookies Author: Sergio Description: TotalCMS is affected by Arbitrary File Upload - XSS vulnerability which allows Cross-Site Scriting XSS and also stealing session cookies Attack Vectors: A vulnerability in "Total Depot" file upload sanitation allow...

uxss-poc

Universal Cross Site Scripting PoC This is a PoC for CVE-2015-0072 for sequentialy get the targeted websites cookies. Disclaimer This Proof of Concept is for educational purpose only. Please do not use it against any system without prior permission. You are responsible for yourself for what you d...

CVE-2023-34838

CVE-2023-34838 — eScan Management Console Stored XSS Overview Microworld Technologies eScan Management Console version 14.0.1400.2281 is vulnerable to a Stored Cross-Site Scripting XSS attack. An authenticated attacker with access to the role management feature can inject a malicious script into...

WPTimeCapsulePOC

Backup and Staging by WP Time Capsule 1.21.16 - Authentication Bypass Proof Of Concept An authentication bypass was recently discovered https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ on WP Time Capsule 1.21.16 . This PoC prove how the issue works and how it can be...

codoforum

CVE-2020-5842 Stored XSS Vulnerability in Codoforum 4.8.3 Listed in: Exploit-db, Cve Mitre and The daily swig While I was searching for a free forum software for our community I found Codoforum. After installing it We Vyshnav Vizz tried a few simple XSS payloads to ensure the security and suddenl...

CVE-2025-63441

CVE-2025-63441 Title: Reflected XSS via arbitrarily supplied URL parameter param at endpoint u/administrator/friends Summary: A Reflected Cross-Site Scripting XSS vulnerability was identified in the u/administrator/friends endpoint of the OSSN application. This vulnerability allows attackers to...

CVE-2024-40508

CVE-2024-40508 Cross Site Scripting vulnerability in openPetra v.2023.02 via the serverMConference.asmx function. Description : An unauthenticated user can steal cookies from authenticated user, by exploiting a XSS in openPetra v.2023.02 via the serverMConference.asmx function. Vulnerable Product...

CVE-2025-26244

CVE-2025-26244-POC The code to exploit this vulnerability can be seen in 'spoof.go'. This imitates as an agent to the C2 server. In order to run this vulnerability we need to know: 1. The listener IP address and Port 2. The public key of the listener. 3. The first time check in URL of the listene...

CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 Assigned: 11-12-2025 Problem Type: CWE-79 Cross-Site Scripting Affected Product: “AI Font Matcher” posted 2025-10-10, nid=18425 Product page: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html...

CVE-2024-4367-POC-PDFJS

CVE 2024 4367: PoC pour l'exploitation de XSS Cross-Site Scripting 1. Displaying an Alert XSS Trigger Another exploitation example consists of injecting a simple alert message to check if the attack works. python poc.py "alert'XSS exploit triggered';" Explanation : This code injects an alert...

CVE-2024-46278-teedy_1.11_account-takeover

【CVE-2024-46278】teedy1.11account-takeover 【Teedy 1.11】account takeover via XSS Detail There is a vulnerability that causes XSS when downloading files. XSS vulnerability could allow a Teedy administrator to rob an account with a few clicks. This vulnerability is marked as CVE-2024-46278:...

CVE-2021-40906

CVE-2021-40906 - Reflected XSS in an unauthenticated zone Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Author: Edgar Augusto Loyola Torres. Attack type: Reflected XSS Solution: Update to Software Revision 1.6.0p26 or later Summary: CheckMK Raw Edition...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...