CVE-2015-9251

CVE-2015-9251 [email protected] 针对 jQuery 低于 3.0.0 版本的 CVE-2015-9251 概念验证（PoC）。 CVE-2015-9251 - PoC 漏洞利用 此仓库包含 CVE-2015-9251 漏洞在 jQuery 库中的 概念验证 PoC 。该漏洞允许通过未经过滤的 JSONP 调用实施跨站脚本（XSS）攻击，原因在于 jQuery 在 3.0.0 之前版本中允许在 callback 参数中注入代码。 描述 CVE-2015-9251 影响 jQuery 3.0.0 之前版本。该漏洞通过操控 JSONP 请求中的...

CVE-2019-10092

CVE-2019-10092：Apache HTTP Server "Proxy Error" 页面中的有限跨站脚本攻击 在 Apache HTTP Server 2.4.0-2.4.39 版本中，报告了一个影响 modproxy 错误页面的有限跨站脚本问题。攻击者可能导致错误页面上的链接格式错误，进而指向他们选择的页面。只有在服务器启用了代理功能但配置不当导致显示代理错误页面时，才可能利用此漏洞。 厂商披露： 厂商的披露及对此漏洞的修复可在此处找到：这里。 利用条件： 此漏洞需要： 能够访问 "Proxy Error" 页面的途径 用户交互 概念验证： 更多细节和利用过程可在此 PDF...

EUVD-2026-78826

A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used...

Joplin-CVE-2022-35131

Joplin CVE-2022-35131 XSS 导致 RCE，影响 Joplin 版本 2.8.8 及更早版本。已在 Windows 和 Linux 上测试并生效。 报告并修复于：2022-06 技术概述 1. 创建一条标题包含 JavaScript 有效载荷（payload）的笔记（示例载荷见下文） 2. 按下 Ctrl+P 并在笔记或标题中搜索内容 3. 有效载荷在搜索结果中显示时被执行 4. 通过共享笔记本可实现远程代码执行 问题在于 GotoAnything.tsx 第 509 行使用 dangerouslySetInnerHTML...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 由我发现的漏洞 CVE-2019-15053 公告：advisory.txt 基本信息 root@kitploit: Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and before Tested Versions....: 1.4.2...

CVE-2024-4367-PDF.js-xss

CVE-2024-4367–PDF.js-xss CVE-2024-4367–PDF.js-xss 下载环境，解压，进入 root@kitploit: unzip cve-2024-4367-lab cd cve-2024-4367-lab 环境启动命令 root@kitploit: mkdir upload chmod 777 upload docker-compose up -d...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.38 packages and security update

Red Hat OpenShift Container Platform release 4.20.38 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.14 packages and security update

Red Hat OpenShift Container Platform release 4.22.14 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

CVE-2026-54477

CVE-2026-54477：管理面板缺少安全标头（点击劫持 / XSS） 公告 字段| 值 ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03（Gardyn IoT Hub） CVSS 3.1| 5.4（中危） 向量（3.1）| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 向量（4.0）| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CWE（CISA 分配）| CWE-644（HTTP 标头脚本语法中和不当）...

CVE-2026-50229

⚡ CVE-2026-50229 — Apache Tomcat 示例跨站脚本攻击利用 🔴 高级跨站脚本攻击（XSS）扫描与利用工具 —— Apache Tomcat 示例 Web 应用 📌 概述 CVE-2026-50229 是发现于 Apache Tomcat 所捆绑的 示例 Web 应用 中的一个 跨站脚本（XSS） 漏洞。该缺陷存在于 webapps/examples/jsp/num/ 目录下的 numguess.jsp 演示页面中，未经过滤的 HTTP 请求参数会在未进行 适当的清理或转义 的情况下直接反射回受害者的浏览器。 本仓库提供一个用 Python 编写的...

Microsoft Exchange Server - Cross-Site Scripting

Microsoft Exchange Server, or OWA, is vulnerable to a cross-site scripting vulnerability in refurl parameter of frowny.asp. id: CVE-2021-31195 info: name: Microsoft Exchange Server - Cross-Site Scripting author: infosecsanyam severity: medium description: Microsoft Exchange Server, or OWA, is...

Centos Web Panel 0.9.8.480 - Local File Inclusion

Centos Web Panel version 0.9.8.480 suffers from local file inclusion vulnerabilities. Other vulnerabilities including cross-site scripting and remote code execution are also known to impact this version. id: CVE-2018-18323 info: name: Centos Web Panel 0.9.8.480 - Local File Inclusion author:...

Resourcespace - Cross-Site Scripting

ResourceSpace before 9.6 rev 18290 is affected by a reflected cross-site scripting vulnerability in plugins/wordpresssso/pages/index.php via the wordpressuser parameter. id: CVE-2021-41951 info: name: Resourcespace - Cross-Site Scripting author: coldfish severity: medium description: ResourceSpac...