Apache OFBiz <=16.11.07 - Cross-Site Scripting

Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized. id: CVE-2020-1943 info: name: Apache OFBiz =16.11.07 - Cross-Site Scripting author: pdteam severity: medium description: Apache OFBiz 16.11.01 to 16.11.07 ...

CHIYU TCP/IP Converter - Cross-Site Scripting

CHIYU BF-430, BF-431 and BF-450M TCP/IP Converter devices contain a cross-site scripting vulnerability due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi. id: CVE-2021-31250 info: name: CHIYU TCP/IP Converter - Cross-Site Scripting author: geeknik...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 XSS到RCE, Wonder CMS 3.2.0 = 3.4.2 使用方法 root@kitploit: ➜ CVE-2023-41425 python3 exploit.py Enter target URL RHOST, e.g., http://example.com/loginURL: http://redacted.com/loginURL Enter your local host IP LHOST, e.g., 10.10.14.xxx: xx.xx.xx.xx Enter your local web serv...

CVE-2023-50465

MonicaHQ XSS Explotación de XSS en MonicaHQ Crea una cuenta Crea un contacto En Documentos, sube un archivo SVG malicioso root@kitploit: alert"Monicahq XSS Poc"; Accede al archivo subido...

weaponised-XSS-payloads

Payloads de XSS armados Payloads XSS diseñados para convertir alert1 en un P1. La entrada del blog Este repositorio se publicó junto con un artículo de blog titulado "How to Upgrade Your XSS Bugs from Medium to Critical" https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4...

CVE-2025-68461

CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting XSS vulnerability via the animate tag in an SVG document. How does this detection method work? Extracts Roundcube version from the "rcversion" JSON field in the response, parses it into...

CVE-2026-1025

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

POC-CVE-2026-32621-Apollo-Federation-XSS-Vulnerability

CVE-2026-32621 - PoC de contaminación de prototipos en Apollo Federation Descripción general...

CVE-2026-1031

IBM Common Licensing Agent versions 9.0, 9.0.0.1, 9.0.0.2 and IBM ART versions 9.0, 9.0.0.1, 9.0.0.2 are affected by a cross-site scripting vulnerability. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering its intended functionality and potentially leading to ...

test-xss-swagger-CVE-2019-1749

Este repositorio no tiene un README...

CVE-2020-11022

Así que así Así que, amigos, CVE-2020-11022 es una vulnerabilidad en jQuery por debajo de la versión 3.5.0 o superior. La vulnerabilidad CVE-2020-11022 en sí misma desencadena un XSS aprovechando la manipulación del DOM como .html, .append, y otras para ejecutar código XSS malicioso. 1. Verificar...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Plantilla de Detección Nuclei Plantilla Nuclei para detección no intrusiva de XSS2Shell , un parser diferencial preautenticado en el núcleo de WordPress que permite inyección de elementos DOM en la página de inicio de sesión, sirviendo de base para una cadena de XSS → RCE. ⚠️ Esta...

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

XSS2Shell-CVE-2026-64638

Este repositorio no tiene un README...

EUVD-2026-82789

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2018-25031

POC de Cross-Site Scripting en Swagger UI: CVE-2018-25031 utilizando Selenium en Python Este repositorio contiene un script en Python que demuestra una prueba de concepto POC de una vulnerabilidad de Cross-Site Scripting XSS en Swagger UI, usando la biblioteca Selenium. El objetivo de esta POC es...

WSO2-2020-0731

WSO2-2020-0731: XXE and XSS vulnerabilities in WSO2 Carbon A potential XXE and XSS have been identified in multiple WSO2 Products. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor requested a CVE for these...

WSO2-2021-1261

WSO2-2021-1261: Múltiples Cross-Site Scripting en WSO2 ESB Debido a una codificación de salida inadecuada, se han identificado múltiples ataques de Cross Site Scripting XSS en WSO2 ESB. Divulgación del proveedor: La divulgación del proveedor y la corrección para esta vulnerabilidad se pueden...

CVE-2023-37191

CVE-2023-37191 — Issabel PBX 4.0.0-6: Cross-Site Scripting Almacenado XSS Resumen...

sudowp-hooks-visualizer

SudoWP Hooks Visualizer Colaboradores: SudoWP, WP Republic Autores originales: Stuart O'Brien, cxThemes Tags: hooks, actions, filters, developer-tool, debug, security-fork, cve-2024-6297 Requiere al menos: 5.8 Probado hasta: 6.7 Etiqueta estable: 1.3.2 Licencia: GPLv2 o posterior Aviso de segurid...