Lucene search
+L

11686 matches found

Kitploit
Kitploit
added 2026/09/22 12:15 p.m.8 views

CVE-2021-39512-BigTreeCMS-v4.4.14-AccountTakeOver

BigTreeCMS-v4.4.14-Unauthenticated-CSRF-AccountTakeOver Unauthenticated CSRF Account TakeOver in BigTreeCMS v4.4.14 All searchable modules in the admin panel of BigTreeCMS v4.4.14 are vulnerable to reflected DOM-XSS via the URI. Search queries are reflected on the page without proper sanitization...

6.2AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/22 12:11 p.m.9 views

CVE-2017-7038

CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability root@kitploit: var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayloa...

6.1CVSS7.1AI score0.03536EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/22 10:12 a.m.8 views

CVE-2020-13889

Author: Andre k Lorenci Contact: [email protected] CVE-2020-13889 Hello, this vulnerability consists in a function called showAlert in the administration panel of bludit,that when accessed in DOM, allows users define the text to be popped up in the message box. But this function dont have an...

5.4CVSS5.8AI score0.00857EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/22 9:53 a.m.19 views

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

5.6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/22 9:40 a.m.13 views

CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

6.1CVSS6.2AI score0.25136EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/22 7:03 a.m.14 views

reDOM

reDOM root@kitploit: ██████╗ ███████╗██████╗ ██████╗ ███╗ ███╗ ██╔══██╗██╔════╝██╔══██╗██╔═══██╗████╗ ████║ ██████╔╝█████╗ ██║ ██║██║ ██║██╔████╔██║ ██╔══██╗██╔══╝ ██║ ██║██║ ██║██║╚██╔╝██║ ██║ ██║███████╗██████╔╝╚██████╔╝██║ ╚═╝ ██║ ╚═╝ ╚═╝╚══════╝╚═════╝ ╚═════╝ ╚═╝ ╚═╝ A Burp Suite extension...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/22 5:46 a.m.8 views

https-nj.gov---CVE-2020-11022

https-nj.gov---CVE-2020-11022 Vulnearability Report of the New Jersey official site Potential XSS vulnerability in jQuery.htmlPrefilter and related methods. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others...

6.9CVSS6.9AI score0.99215EPSS
SaveExploits8References1
Kitploit
Kitploit
added 2026/09/22 5:22 a.m.17 views

domdig

DOMDig DOMDig 是一个运行在 Chromium 浏览器内部的 DOM XSS 扫描器,可以递归地扫描单页应用(SPA)。 与其他扫描器不同,DOMDig 通过跟踪 DOM 修改和 XHR/fetch/websocket 请求来爬取任何 Web 应用(包括 Gmail),并通过触发事件来模拟真实用户交互。在此过程中,输入字段中会注入 XSS 载荷,并跟踪其执行情况,以发现注入点及相关的 URL 变更。 它基于 htcrawl 构建,这是一个功能强大的 Node 库,足以轻松爬取 Gmail 账户。 主要特性 在真实浏览器(Chromium)内运行 递归 DOM 爬取引擎 处理...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/22 5:22 a.m.69 views

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

5.7AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/22 5:21 a.m.146 views

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

5.7AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/22 4:37 a.m.12 views

PoC-CVE-2024-24035

CVE-2024-24035 Título The SIL 3.1 es vulnerable a Cross Site Scripting XSS en el parámetro "hmessage". Fecha: 2024-01-14 Autor: Elizeu Das Dores Página del proveedor: https://www.setorinformatica.com/ Versión: 3.1 POC CVE-2024-24035 El parámetro "hmessage" es vulnerable a DOM Based Cross Site...

6.1CVSS5.9AI score0.00443EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/22 2:45 a.m.9 views

React2Shell-CVE-2025-55182

🎯 React2Shell CVE-2025-55182: From React Server Components to Full RCE Difficulty: Intermediate → Advanced Category: Web Exploitation | Deserialization | RCE 🧩 Task 1: Introduction — Why React2Shell Is a Big Deal CVE-2025-55182, nicknamed React2Shell , is one of those vulnerabilities that instant...

10CVSS7.8AI score0.99802EPSS
SaveExploits391
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.107 views

WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting

WordPress Elementor Website Builder plugin before 3.1.4 contains a DOM cross-site scripting vulnerability. It does not sanitize or escape user input appended to the DOM via a malicious hash. id: CVE-2021-24891 info: name: WordPress Elementor Website Builder 3.1.4 - Cross-Site Scripting author:...

6.1CVSS6.2AI score0.25136EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.133 views

Ghost CMS <=4.32 - Cross-Site Scripting

Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code. id: CVE-2021-29484 info: name: Ghost CMS =4.32 - Cross-Site...

6.8CVSS6.6AI score0.07935EPSS
SaveExploits1References7
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.115 views

Yonyou U8 13.0 - Cross-Site Scripting

Yonyou U8 13.0 contains a DOM-based cross-site scripting vulnerability via the component /u8sl/WebHelp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

6.1CVSS6.1AI score0.41722EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.27 views

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

6.9CVSS5.9AI score0.01083EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.27 views

Hoppscotch <= 2026.2.1 - Open Redirect

Hoppscotch = 2026.2.1 is vulnerable to a DOM-based open redirect on the /enter page. The redirect query parameter is passed directly to windowz location.href with no origin validation. Requires one additional query parameter to trigger. Exploited via a crafted URL such as...

6.1CVSS5.7AI score0.00401EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.14 views

Mailcow Dockerized Swagger UI - Cross-Site Scripting

Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI before 4.11.1 that is affected by a DOM-based Cross-Site Scripting XSS vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code...

8.2CVSS8AI score0.01524EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/22 12:56 a.m.11 views

burp-dom-scanner

Burp DOM 扫描器 这是一个 Burp Suite 的扩展,用于对单页应用进行递归爬取和扫描。 它会运行一个 Chromium 浏览器来扫描网页中的基于 DOM 的 XSS。 它还可以收集爬取期间发出的所有请求(XHR、fetch、websocket 等),允许将它们转发到 Burp 的 Proxy、Repeater 和 Intruder。 需要 node 和 DOMDig。 下载 最新版本可以在此下载。 安装 1. 安装 node 2. 安装 DOMDig 3. 下载并加载扩展 4. 在扩展的 UI 中设置 node 可执行文件的路径以及 domdig.js 的路径。 扫描引擎...

5.8AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/22 12:56 a.m.68 views

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

5.5AI score
SaveExploits0References2
Rows per page
Query Builder