CVE-2023-43770-PoC

CVE-2023-43770-PoC PoC 针对存储型XSS CVE-2023-43770 漏洞的概念验证 描述 Roundcube 在 1.4.14 之前、1.5.x 在 1.5.4 之前、以及 1.6.x 在 1.6.3 之前的版本，由于 program/lib/Roundcube/rcubestringreplacer.php 的行为，允许通过包含精心构造链接的 text/plain 电子邮件消息进行 XSS 攻击。 攻击链 精心构造的邮件 - 受害者接收并打开邮件 - JavaScript 执行（存储型） PoC 视频：...

CVE-2023-43770-POC

CVE-2023-43770 POC 针对最近发现的 CVE-2023-43770 漏洞的概念验证。 Roundcube 在 1.4.14 之前、1.5.x 在 1.5.4 之前以及 1.6.x 在 1.6.3 之前的版本，由于 program/lib/Roundcube/rcubestringreplacer.php 的行为，允许通过带构造链接的 text/plain 电子邮件消息触发 XSS。 用法 root@kitploit: python cve-2023-43770.py -e [email protected] -p Attack3rPwd -t...

CVE-2026-20841

🛡️ CVE-2026-20841 - Windows 记事本安全测试工具 ⚠️ 什么是 CVE-2026-20841？ CVE-2026-20841 是 Windows 记事本应用程序中一个已知的安全弱点。它影响 Markdown 功能，该功能允许记事本显示带有可点击链接的格式化文本。此弱点的产生是因为记事本内部运行的 Markdown 引擎没有限制其允许的链接类型（称为 URL 协议）。这意味着攻击者可以创建一个链接，当用户点击时，会导致记事本运行用户并未打算运行的程序或命令。...

CVE-2026-76960

SAP S/4HANA Finance (Advanced Payment Management) is affected by a Cross-Site Request Forgery (CSRF) vulnerability caused by insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page; when an authenticated victim interacts with it, uninte...

Astra Linux – Vulnerability in LibreOffice

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so that it does not match the denylist, resulting in ShellExecute attempting to launch an executable file...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-48911

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

CVE-2026-66300

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

EUVD-2026-52869

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

GHSA-5VJC-7CXW-4W6J Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Summary The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service ReDoS. Details The RegExp for convolution is defined as...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

PT-2026-64214

Name of the Vulnerable Software and Affected Versions React Router versions 6.30.2 through 6.30.4 React Router versions 7.9.6 through 7.12.0 Description Applications that allow open redirects are susceptible to Cross-Site Scripting XSS, a technique where malicious scripts are injected into truste...

Plone < 3.3.6 XSS

The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...

EUVD-2026-46045

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-44752

CVE-2026-44752 affects SAP NetWeaver Application Server Java (often noted with the Configuration Wizard). The vulnerability is a Cross-Site Scripting (XSS) issue where an unauthenticated attacker can inject malicious JavaScript through crafted URLs. When a victim loads such a URL, the script runs...

OPENSUSE-SU-2026:21208-1 Security update for cockpit

This update for cockpit fixes the following issue - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040...

EUVD-2026-41054

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

PT-2026-54015

Name of the Vulnerable Software and Affected Versions Storage Concentrator SC & SCVM affected versions not specified Description Reflected cross-site scripting occurs because unsanitized content is echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an...