CVE-2026-76983

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...

CVE-2026-76984

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates and header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with ". A backslash before a double quote mean...

CVE-2026-76982

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2026-75802

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

PwnXSS

Мощный сканер XSS, написанный на Python 3.7 Установка Требования: BeautifulSoup4 root@kitploit: pip install bs4 requests root@kitploit: pip install requests python 3.7 Команды: root@kitploit: git clone https://github.com/pwn0sec/PwnXSS chmod 755 -R PwnXSS cd PwnXSS python3 pwnxss.py --help...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple: Хранимая XSS v2.2.18 Автор: Sergio Описание: Уязвимость межсайтового скриптинга в CMSmadesimple v.2.2.18 позволяет локальному злоумышленнику выполнить произвольный код с помощью специально созданного скрипта в верхнем каталоге Top Directory меню выбора файлов File Picker Menu...

CVE-2023-49984

CVE-2023-49984 School Fees Management System v1.0 - Уязвимость межсайтового скриптинга XSS в поле/параметре "name" на странице "/management/settings" Описание : Уязвимость межсайтового скриптинга XSS в компоненте "/management/settings" School Fees Management System v1.0 позволяет злоумышленникам...

CVE-2024-51032

CVE-2024-51032 Описание Уязвимость межсайтового выполнения сценариев XSS в managerecipient.php системы управления дорожными налогами Sourcecodester Toll Tax Management System 1.0 позволяет удаленным аутентифицированным пользователям внедрять произвольные веб-сценарии через поле ввода "owner". Тип...

DeimosC2

DeimosC2 Deimos находится в статусе: DEPRECATED DeimosC2 больше не поддерживается и содержит известную XSS-уязвимость CVE-2025-26244. Спасибо JaRm222 за обнаружение уязвимости и уведомление нас. Его описание уязвимости можно найтиздесь. DeimosC2 — это инструмент командования и управления C2 для...

awesome-web-security

Awesome Web Security 🐶 웹 보안 자료 및 리소스의 엄선된 목록. 말할 필요도 없이, 대부분의 웹사이트는 다양한 유형의 버그로 인해 결국 취약점으로 이어질 수 있습니다. 왜 이런 일이 자주 발생할까요? 잘못된 설정, 엔지니어의 보안 기술 부족 등 여러 요인이 관련될 수 있습니다. 이에 대응하기 위해 최첨단 침투 기술을 학습하기 위한 웹 보안 자료 및 리소스의 엄선된 목록을 제공하며, 먼저 이 글 "So you want to be a web security researcher?"를 읽어보시기를 적극 권장합니다...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-4917, CVE-2026-4918, CVE-2026-4919)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4917 DESCRIPTION: IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker could send a specially crafted URL...

CVE-2026-51565

CVE-2026-51565 CVE-2026-51565 보안 권고 설명 Milk admin =0.9.8의 Modules/Docs/DocsController.php에 있는 사이트 간 스크립팅XSS 취약점으로 인해 원격 공격자가 조작된 요청의 action 매개변수를 통해 임의의 웹 스크립트 또는 HTML을 주입할 수 있습니다. 완화 조치 게시 시점 기준으로 이 취약점에 대한 공식 패치는 제작자로부터 제공되지 않았으며, 제가 이를 보고한 지 5개월이 지났습니다. 업데이트된 버전이 출시될 때까지는 취약한 action 매개변수를 노린 악...

CVE-2026-82868

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — OpenKM v6.3.12 저장형 XSS 취약점 발견 및 보고자:Dharmendra Kumar — 보안 연구원 사이버 보안 | 침투 테스트 | 취약점 연구 | 책임 있는 공개 📌 목차 개요 CVE 세부 정보 영향받는 제품 취약점 설명 근본 원인 분석 영향 및 위험 평가 개념 증명 PoC...

CVE-2024-48415

CVE-2024-48415 설명 itsourcecode Loan Management System v1.0은는 Borrowers 페이지의 신규 대출자new borrowers 기능에서 lastname, firstname, middlename, address, contactno, email 및 taxid 매개변수에 조작된 페이로드를 통해 XSSCross Site Scripting 취약점에 노출됩니다. 취약점 유형: XSSCross Site Scripting 제품 공급업체: itsourcecode 영향을 받는 제품 코드 베이스:...

CVE-2026-82868

@pdfme/schemas versions before 5.5.9 contain a cross-site scripting (XSS) vulnerability in the SVG schema plugin . User-supplied SVG content is rendered directly to innerHTML without sanitization , allowing attackers to inject malicious SVG with embedded scripts, event handlers, or foreignObject ...

EUVD-2026-68403

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

EUVD-2026-68402

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

CVE-2026-82867

@pdfme/schemas versions before 5.5.9 contain a cross-site scripting (XSS) vulnerability in the Select schema plugin . The root cause is the failure to sanitize option values before interpolating them into HTML via innerHTML. An attacker who can supply a malicious template with crafted option valu...

EUVD-2026-68400

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...