EUVD-2026-95264

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2025-25296

CVE-2025-25296 Proof of Concept POC Description This project demonstrates a Proof of Concept POC for the CVE-2025-25296 vulnerability affecting Label Studio, an open-source data labeling tool. The vulnerability resides in the /projects/upload-example endpoint, which fails to sanitize user-provide...

XSS-PoCs

XSS-PoCs Cross-Site Scripting Proof of Concepts...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

CVE-2026-27621

CVE-2026-27621: TypiCMS Core has Stored Cross-Site Scripting XSS via SVG File Upload Overview Field| Details ---|--- CVE ID| CVE-2026-27621 Severity| MEDIUM Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products typicms/core versions: 16.1.7 CWE Classification CWE-79: Improper...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107397

The event management system Indico is vulnerable to a Cross-Site Scripting (XSS) flaw in its minutes editor prior to version 3.3.13 . The root cause is that users with content creation privileges, such as speakers, can store crafted HTML within event minutes. When concurrent edits occur on the sa...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107396 Indico: Cross-Site-Scripting in link fields

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user...

CVE-2026-40804

The aBlocks WordPress plugin (versions

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.20.41 security update

Red Hat build of MicroShift release 4.20.41 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2024-39123-Exploit

CVE-2024-39123: Stored XSS in Calibre-web 0.6.21 Exploit Details Exploit Title : Stored XSS in Calibre-web Date : 2024-05-07 Exploit Authors : Catalin Iovita & Alexandru Postolache Pentest-Tools.com Vendor Homepage : Calibre-web GitHub Repository Version : 0.6.21 - Romesa Tested on : Linux...

CVE-2025-57926

Sink: According to the mechanism of WordPress Core, XSS is prevented in post content, but with this plugin, the content is encoded and then decoded when rendered, unintentionally creating an XSS vulnerability." PoC: The base64 encoded payload is PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...

tool-29489

Tool-29489 Overview 🔍: This tool is used to identify URLs with CVE-2023-29489 vulnerability. The tool uses payloads to identify the bug. Help menu of tool-29489: python main.py help URL inputfile outputfile -h or --help : To display help options. -u or --url : To input URL to check. -i or --input...

CVE-2026-37750

CVE-2026-37750 — School Management System 1.0 - Reflected XSS Details Field| Info ---|--- CVE ID| CVE-2026-37750 Type| Reflected Cross-Site Scripting XSS Severity| Medium CVSSv3: 6.1 Vendor| mahmoudai1 Product| School Management System Version| 1.0 Discoverer| Varad AP Mene Date| 2026-04-16 CWE|...

CVE-2026-30695

CVE-2026-30695 - XSS in Zucchetti Axess Summary A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices XA4, X3/X3BIO, X4, X7, XIO, i-door, i-door+. The vulnerability is caused by improper sanitization of user-supplied...

CVE-2021-41349

Microsoft Exchange Exploit CVE-2021-41349 Exploiting: CVE-2021-41349 This exploiting tool creates a Form for posting XSS Payload to the target Exchange server. You need to create a js containing your desire to do. Usage 1. Create Your js Payload and upload it somewhare. 2. run the CVE-2021-41349....

mitigation-cve-2019-9787

mitigación-cve-2019-9787 POC 1. xss simple : 2. csrf simple: código del sitio web del atacante--- https://github.com/kuangting4231/wordpress.github.io 3. csrf con ejecución remota de código: código del sitio web del atacante--- https://github.com/kuangting4231/assigment1.github.io Mitigación 1...

CVE-2021-45416

Docker RosarioSIS Installation Minimum requirements: Docker & Git working. You can pull the image from DockerHub or: 1. docker on $ git clone https://github.com/dnr6419/CVE-2021-45416.git $ cd CVE-2021-45416 $ docker-compose up -d 2. Visit the URL and Install the Database...