CVE-2023-44813

CVE-2023-44813 Уязвимость отраженного межсайтового скриптинга XSS в параметре mode функции Invite Friend в mooSocial v3.1.8, которая позволяет злоумышленникам похищать сессионные cookie пользователей и выдавать себя за их учетную запись через специально созданный URL. Уязвимый параметр: mode...

CVE-2021-24917

Эксплойт для CVE-2021-24917...

CVE-2018-25031

CVE-2018-25031 설명: Swagger UI 4.1.3 이전 버전에서는 원격 공격자가 스푸핑 공격을 수행할 수 있습니다. 공격자는 피해자가 조작된 URL을 열도록 유도함으로써 이 취약점을 악용하여 원격 OpenAPI 정의를 표시할 수 있습니다. 공격 전 스크린샷: PoC: root@kitploit: /index.html?configUrl=https://raw.githubusercontent.com/afine-com/CVE-2018-25031/main/poc.json...

RosarioSIS 6.7.2 - Cross-Site Scripting

RosarioSIS version 6.7.2 and earlier contains a reflected cross-site scripting XSS vulnerability in the Preferences module. The 'tab' parameter in Modules.php is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code via a crafted URL. id: CVE-2020-15718 info: name:...

Post Sync Plugin <= 1.1 - Cross-Site Scripting

Post Sync WordPress plugin = 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...

Widget4Call WordPress - Cross-Site Scripting

Widget4Call WordPress plugin = 1.0.7 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13099 info: name:...

WordPress StageShow <5.0.9 - Open Redirect

WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshowredirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter. id: CVE-2015-5461 info: name:...

Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting

Bulk Me Now! WordPress plugin = 2.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

WP Dream Carousel < 1.0.1b - Cross-Site Scripting

WP Dream Carousel WordPress plugin 1.0.1b contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires victim to load a...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...

iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting

iBuildApp WordPress plugin through 0.2.0 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13326 info:...

CVE-2020-28415

CVE-2020-28415 제안된 설명 TranzWare Payment Gateway 3.1.12.3.2에는 반사형 크로스 사이트 스크립팅XSS 취약점이 존재합니다. 원격의 인증되지 않은 공격자는 조작된 URL을 통해 임의의 HTML 코드를 실행할 수 있습니다CVE-2020-28414와 다른 벡터. 취약점 유형 크로스 사이트 스크립팅 XSS 제품 공급업체 TranzWare 영향을 받는 제품 코드 베이스 Payment Gateway 3.1.12.3.2. 공격 유형 원격 영향 코드 실행 true 공급업체가 취약점을 확인하거나...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

EUVD-2026-76700

A reflected cross-site scripting XSS vulnerability in the p.rfihub.com component of Zeta Marketing Platform ZMP v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter...

CVE-2023-28432

CVE-2023-28432 Minio는 Go 언어 기반의 객체 스토리지 서비스입니다. Amazon S3 클라우드 스토리지 서비스 인터페이스의 대부분을 구현하며, S3의 오픈소스 버전으로 볼 수 있습니다. 대용량 비정형 데이터예: 이미지, 비디오, 로그 파일, 백업 데이터, 컨테이너/가상 머신 이미지 등를 저장하는 데 매우 적합합니다. MinIO의 verify 인터페이스에 민감한 정보 누출 취약점이 존재하며, 공격자는 특수한 URL 주소를 구성하여 시스템의 민감한 정보를 읽을 수 있습니다. 간단한 취약점 테스트 및 활용 도구...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFD отражённая загрузка файла для MediaWiki Удалённый пользователь может создать специально сформированный URL для целевого сайта, который при загрузке целевым пользователем заставит скрипт 'api.php' загрузить файл, содержащий команды оболочки CVE-2017-8809. Файл будет предоставле...

CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2026-73718

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...

CVE-2021-31717

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:25+00:00| seen| https://t.me/hackingAttack/22454 2026-09-02 01:02:57+00:00| seen| https://t.me/hackingAttack/22454 2026-09-07 17:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/22454 2026-09-08 00:00:38+00:00|...

CVE-2026-73718 Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...