The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting

The Wordpress plugin Code Snippets before 2.14.3 does not escape the snippets-safe-mode parameter before reflecting it in attributes, leading to a reflected cross-site scripting issue. id: CVE-2021-25008 info: name: The Code Snippets WordPress Plugin 2.14.3 - Cross-Site Scripting author: cckuailo...

WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting

WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages. id: CVE-2021-24298 info: name: WordPress Simple...

WebCTRL OEM <= 6.5 - Cross-Site Scripting

WebCTRL OEM 6.5 and prior is susceptible to a cross-site scripting vulnerability because the login portal does not sanitize the operatorlocale GET parameter. id: CVE-2021-31682 info: name: WebCTRL OEM = 6.5 - Cross-Site Scripting author: gy741,dhiyaneshDk severity: medium description: WebCTRL OEM...

Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting

Redwood Report2Web 4.3.4.5 and 4.5.3 contains a cross-site scripting vulnerability in the login panel which allows remote attackers to inject JavaScript via the signIn.do urll parameter. id: CVE-2021-26710 info: name: Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting author: pikpikcu...

Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting

The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2....

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter. id: CVE-2020-26153 info:...

IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting

IceWarp Webmail Server through 11.4.4.1 contains a cross-site scripting vulnerability in the /webmail/ color parameter. id: CVE-2020-8512 info: name: IceWarp WebMail Server =11.4.4.2 or apply the vendor-provided patch to mitigate the vulnerability. reference: -...

IceWarp WebMail 11.4.5.0 - Cross-Site Scripting

IceWarp WebMail 11.4.5.0 is vulnerable to cross-site scripting via the language parameter. id: CVE-2020-27982 info: name: IceWarp WebMail 11.4.5.0 - Cross-Site Scripting author: madrobot severity: medium description: IceWarp WebMail 11.4.5.0 is vulnerable to cross-site scripting via the language...

Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting

Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field. id: CVE-2020-29395 info: name: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting author: daffainfo severity: medium description: Wordpress EventON Calendar 3.0.5 is...

Rukovoditel <= 2.7.2 - Cross-Site Scripting

A stored cross site scripting XSS vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter. id: CVE-2020-35987 info: name: Rukovoditel = 2.7.2 - Cross-Site...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2710 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting author:...

Aruba Instant Access Point (IAP) - Cross-Site Scripting

A remote cross-site scripting xss vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below;...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

CVE-2024-39123-Exploit

CVE-2024-39123: Calibre-web 0.6.21 における格納型XSS エクスプロイトの詳細 エクスプロイトタイトル : Calibre-web における格納型XSS 日付 : 2024-05-07 エクスプロイト作成者 : Catalin Iovita & Alexandru Postolache Pentest-Tools.com ベンダーホームページ : Calibre-web GitHub リポジトリ バージョン : 0.6.21 - Romesa テスト環境 : Linux 5.15.0-107、Python 3.10.12、lxml 4.9.4 CVE :...

tool-29489

Tool-29489 概要 🔍: このツールは、CVE-2023-29489 の脆弱性を持つ URL を特定するために使用されます。 このツールはペイロードを使用してバグを特定します。 tool-29489 のヘルプメニュー: python main.py help URL inputfile outputfile -h または --help : ヘルプオプションを表示します。 -u または --url : チェックする URL を入力します。 -i または --input : 入力ファイルを指定します。 -o または --output : 出力ファイルを指定します。...

CVE-2026-37750

CVE-2026-37750 — School Management System 1.0 - 反射型XSS 詳細...

CVE-2026-30695

CVE-2026-30695 - Zucchetti Axess における XSS 概要 Zucchetti Axess アクセス制御デバイス（XA4、X3/X3BIO、X4、X7、XIO、i-door、i-door+）の Web ベース設定インターフェースに、クロスサイトスクリプティング（XSS）の脆弱性が存在します。 この脆弱性は、/filemanager.cgi エンドポイントの dirBrowse パラメータにおけるユーザー入力のサニタイズ処理が不適切であることに起因します。認証された攻撃者は、管理者ユーザーのコンテキストで実行される任意の JavaScript...

CVE-2021-41349

Microsoft Exchange Exploit CVE-2021-41349 悪用対象: CVE-2021-41349 この悪用ツールは、対象のExchangeサーバーにXSSペイロードをPOSTするためのフォームを作成します。 実行したい内容を含むjsファイルを作成する必要があります。 使用方法 1. jsペイロードを作成し、どこかにアップロードします。 2. 以下の手順に従ってCVE-2021-41349.pyを実行します。 root@kitploit: python3 CVE-2021-41349.py "https://mail.target.com"...

CVE-2021-45416

Docker RosarioSIS インストール 最低要件: Docker と Git が動作していること。 DockerHub からイメージをプルするか、以下の手順を実行します: 1. docker を起動 root@kitploit: $ git clone https://github.com/dnr6419/CVE-2021-45416.git $ cd CVE-2021-45416 $ docker-compose up -d 2. URL にアクセスしてデータベースをインストールする root@kitploit:...