CVE-2026-103047

A flaw was found in the MediaWiki CentralAuth extension. Improper neutralization of input in internationalization i18n messages allows a remote attacker to conduct stored Cross-Site Scripting XSS attacks. If exploited, malicious scripts execute within an unsuspecting user's browser session,...

EUVD-2026-89577

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-102847

The gedelumbung HospitalManagement software is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the Guest Book component. Specifically, the kirim function within the file application/modules/web/controllers/buku_tamu.php fails to properly handle the nama , email , and pesan arguments. Th...

EUVD-2026-89567

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/bukutamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes...

CVE-2026-71189

The Toptech TMS7 and TopHAT platforms are vulnerable to a Cross-site Scripting (XSS) vulnerability. An attacker can construct a malicious request that, when triggered by another application user, executes arbitrary JavaScript code within the user's browser session. The provided documents do not s...

Security Bulletin: InfoSphere Data Replication - Data Replication for Availability is affected by arbitrary code execution, cross-site scripting, and denial of service

Summary IBM has released the below fix for IBM InfoSphere Data Replication - Data Replication for Availability Db2U Qreplication container in response to multiple vulnerabilities. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2026-33916...

CVE-2026-102329

A cross-site scripting flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=563297615 https://code.google.com/p/chromium/issues/detail?id=102329...

CVE-2026-102329

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

EUVD-2026-89395

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

CVE-2026-102329

A Cross-site scripting (XSS) vulnerability exists in the WebUI of Google Chrome prior to version 154.0.8037.92 . This flaw allows a remote attacker to bypass the web origin policy to access a privileged page by navigating the user to a crafted HTML page . No specific exploit code or in-the-wild e...

CVE-2026-102831

A flaw was found in JupyterLab. This vulnerability allows Cross-Site Scripting XSS when pasting notebook cells from the system clipboard, as the application fails to clear trusted metadata flags from imported cell data. A remote attacker could exploit this by enticing a user to paste malicious ce...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in DOMPurify (CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Multiple Cross-Site Scripting XSS vulnerabilities in DOMPurify CVE-2026-41238, CVE-2026-41239, CVE-2026-41240 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.4.12 on Windows and version 3.4.13 on Linux. Vulnerability Details...

CVE-2023-41425

CVE-2023-41425 描述 WonderCMS 版本 3.2.0 至 3.4.2 中存在一个跨站脚本漏洞，允许远程攻击者通过上传特制脚本到 installModule 组件来执行任意代码。 这是 prodigiousMind 原始漏洞利用的修改版本，扩展了漏洞利用功能，使其能够在本地提供完整的漏洞利用服务，无需依赖外部网络连接。 当你在海上迷失，且发现你的自行车出了问题的时候，它很有用…… 注意：仓库中留下的 xss.js 仅用于演示目的，脚本运行时将用你的配置覆盖它。 用法 usage: exploit.py -h -u URL -lh LHOST -lp LPORT -sh...

CVE-2024-25292

RenderTune RCE A Proof-Of-Concept for CVE-2024-25292 vulnerability. A cross-site scripting XSS vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter. In this repository there is an example...

CVE-2015-9251

CVE-2015-9251 Este repositorio contiene una Prueba de Concepto PoC para CVE-2015-9251, una vulnerabilidad en versiones de jQuery anteriores a la 3.0.0 que permite a los atacantes realizar ataques de Cross-Site Scripting XSS bajo ciertas condiciones...

CVE-2020-9496

CVE-2020-9496 XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 Install requirements $ pip install -r requirements.txt $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar -O...

CVE-2024-37383-POC

CVE-2024-37383-POC CVE-2024-37383 的 PoC（概念验证） 简介 本仓库包含 Roundcube XSS 漏洞（CVE-2024-37383）的概念验证。 关于该漏洞的更多信息可在此处找到：在这里 步骤 启动 Roundcube 如果你还没有运行中的 Roundcube 实例，可以使用 startroundcube.sh 脚本来启动。 你需要安装 Docker。 该脚本目前配置为与 gmx 配合使用，但如果你想使用其他邮件服务商，可以修改脚本中的变量。邮件服务商必须支持 IMAP。 发送包含 payload 的邮件 以下是一些可用于发送带有 payload...

CVE-2019-10092_Docker

CVE-2019-10092 Docker - Apache HTTP Server Uso $ docker-compose up Uso desde Docker Hub $ docker run -p 5555:5555 motikan2010/cve-2019-10092 PoC Disclosures/CVE-2019-10092-Limited Cross-Site Scripting in modproxy Error Page-Apache httpd at master · DrunkenShells/Disclosures...

Bootstrap-with-XSS

Bootstrap 历史漏洞 PoC 集合 这是一个用于学习和研究的静态 HTML 页面，集成了多个 Bootstrap 框架历史上的跨站脚本（XSS）漏洞概念验证（PoC）。 此项目旨在为安全研究人员、开发者和学生提供一个安全、可控的环境，用于理解和验证这些特定的安全漏洞，而无需搭建复杂的服务器环境。 ⚠️ 重要安全警告 仅供学习研究 ：此项目及其所有代码仅用于授权的、合法的安全研究和教学目的。 严禁非法攻击 ：严禁使用此工具或其包含的任何代码对任何您不拥有或未获明确授权的网站进行测试或攻击。未经授权的渗透测试是违法行为。 风险自负 ：您对使用此项目所造成的一切后果负全部责任。 🚀...

CVE-2015-9251

CVE-2015-9251 [email protected] PoC para CVE-2015-9251 jQuery menor a 3.0.0. CVE-2015-9251 - PoC Exploit Este repositorio contiene un Proof of Concept PoC para la vulnerabilidad CVE-2015-9251 en la biblioteca jQuery. La vulnerabilidad permite un ataque de Cross-Site Scripting XSS a través de...