Zimbra Collaboration Suite < 8.8.15 - Improper Encoding

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 update 1, as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing...

WordPress UserPro 4.9.32 - Cross-Site Scripting

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. id: CVE-2019-14470 info: name: WordPress UserPro 4.9.32 - Cross-Site Scripting author: daffainfo severity: mediu...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

WordPress Core <=6.2 - Directory Traversal

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. id: CVE-2023-2745 info: name: WordPress Core =6.2 - Directory Traversal author: nqdung2002 severity: medium description: | WordPress Core is vulnerable to Directory Traversal in...

Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/mynotifications NEWUINAV parameter. id: CVE-2021-36450 info: name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium description: Verint...

CVE-2024-25292

RenderTune RCE Uma prova de conceito para a vulnerabilidade CVE-2024-25292. Uma vulnerabilidade de cross-site scripting XSS no RenderTune v1.1.4 permite que atacantes executem scripts web arbitrários ou HTML por meio de um payload criado injetado no parâmetro Upload Title. Neste repositório há um...

SpaceX-Starlink-Router-Gen-2-XSS

SpaceX / Starlink Router Gen 2 XSS CVE-2023-49965 Sie können die koreanische Version des Beitrags hier sehen : https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-kor TL;DR Eine Cross-Site Scripting XSS-Sicherheitslücke auf der anfänglichen Captive-Portal-Seite des Routers der zweiten...

Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc

Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc WolfCMS-v0.8.3.1 क्रॉस साइट स्क्रिप्टिंग XSS निर्दिष्ट CVE संख्या: CVE-2017-11611...

CVE-2022-29455

CVE-2022-29455 Wordpress-Sicherheitslücke - XSS Cross-Site Scripting Ort der Sicherheitslücke https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Betroffene Version Beispiel - https://www.youtube.com/watch?v=4qvOkSbhcE...

CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS Descrição do NVD Vulnerabilidade de cross-site scripting no EC-CUBE 4.0.0 a 4.0.5 permite que um atacante remoto injete um script especialmente criado no campo de entrada específico do site EC criado com o EC-CUBE. Como resultado, pode levar à execução arbitrária de...

CVE-2022-31299

CVE-2022-31299 Haraj Script 3.7 - XSS Refletido Título do exploit: Haraj Script 3.7 - XSS Refletido Data: 2022-06-13 CVE: CVE-2022-31299 Autor do exploit: Abdulaziz Saad @b4zb0z Homepage do fornecedor: https://angtech.org/ Link do software: https://angtech.org/product/view/3 Versão: 3.7 Testado e...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE A vulnerabilidade de Cross Site Scripting no Wonder CMS v.3.2.0 até v.3.4.2 permite que um atacante remoto execute código arbitrário por meio de um script especialmente criado enviado ao componente installModule. Apenas para fins educacionais Requer conhecimento da...

CVE-2023-34599

CVE-2023-34599 Foram identificadas múltiplas vulnerabilidades de Cross-Site Scripting XSS no Gibbon v25.0.0, que permitem que atacantes executem código JavaScript arbitrário. Prova de Conceito Parâmetro allUsers http://gibbon.local/index.php?q=/modules/Timetable...

-CVE-2022-48150

-CVE-2022-48150 Ich habe die reflected xss vulnerability in shopware 5 gefunden. Für mehr details check mein poc video...

cve-2020-11023-scanner

💥 CVE-2020-11023 Scanner: Finden und besiegen Sie XSS, bevor es zu spät ist! 💥 Werden Sie vom Gespenst der Cross-Site-Scripting XSS-Sicherheitslücken in Ihrem JavaScript-Code heimgesucht? Sorgen Sie sich, dass CVE-2020-11023 Ihre Webanwendungen angreifbar macht? Keine Angst mehr! Der CVE-2020-110...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 XSS zu RCE, Wonder CMS 3.2.0 = 3.4.2 Verwendung ➜ CVE-2023-41425 python3 exploit.py Enter target URL RHOST, e.g., http://example.com/loginURL: http://redacted.com/loginURL Enter your local host IP LHOST, e.g., 10.10.14.xxx: xx.xx.xx.xx Enter your local web server por...

CVE-2019-10779

CVE-2019-10779 GCHQ Stroom ist anfällig für Cross-Site-Scripting aufgrund der Möglichkeit, das Stroom-Dashboard auf einer anderen Website zu laden und unzureichendem Schutz gegen Ursprünge von Fensterereignissen...

cve-2020-35717

CVE-2020–35717 zonote ermöglicht XSS mittels manipulierter Notiz, mit daraus resultierender Remotecodeausführung da Node.js-Integration aktiviert ist. Schritte zur Ausnutzung der Sicherheitslücke Eine beliebige betroffene Version von zonote herunterladen Die zonote-App öffnen xss-rce.znt über Men...

cve-2023-40000

cve-2023-40000 Isso é um PoC do cve-2023-40000. Exploit do Wordpress LiteSpeed Cache. O CVE pode ser aplicado a todas as versões do LiteSpeed Cache --------------------+"; echo "+----------------------------------------------------------------------+";...

hackazon

Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...