4241 matches found
burp-dom-scanner
Burp DOM Scanner Burp Suite의 확장 프로그램으로, 단일 페이지 애플리케이션SPA의 재귀적 크롤링 및 스캔을 가능하게 합니다. Chromium 브라우저를 실행하여 웹페이지에서 DOM 기반 XSS를 스캔합니다. 또한 크롤링 중 발생하는 모든 요청XHR, fetch, websocket 등을 수집하여 Burp의 Proxy, Repeater 및 Intruder로 전달할 수 있습니다. Node.js와 DOMDig가 필요합니다. 다운로드 최신 릴리스는 여기에서 다운로드할 수 있습니다. 설치 1. Node.js 설치 2...
burp-dom-scanner
Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...
VDO.Ninja - DOM-Based Cross-Site Scripting
VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...
NoXss
NoXss NoXss는 반사형 XSS와 DOM 기반 XSS를 지원하는 크로스사이트 스크립트 취약점 스캐너입니다. 매우 빠르며 수백만 개의 URL을 테스트하는 데 적합합니다. 버그 바운티 프로그램에서 일부 XSS 취약점을 발견했습니다. 기능 빠르며 수백만 개의 URL 테스트에 적합 DOM 기반 XSSChrome 또는 Phantomjs 사용 및 반사형 XSS 지원 현재 인젝션 위치에 기반한 8개의 페이로드만 사용 퍼징하지 않음, 더 정확하고 빠름 비동기 요청gevent 사용 및 멀티 프로세싱 단일 URL, 파일 및 Burpsuit...
CVE-2024-30956
CVE-2024-30956 참조 https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM 기반 XSS TOWeb 버전 5 예: http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP URL로 이동하면 JS 코드가 실행됩니다. 참고: src에는 관련 HTML/JS 코드의 복사본이 포함되어 있습니다. TOWeb는 폐쇄 소스이며 비용을 지불하지 않고 이전 버전을 다운로드할 수 없기...
PoC-CVE-2024-24035
CVE-2024-24035 タイトル: SIL 3.1 は "hmessage" パラメータにおいてクロスサイトスクリプティング XSS の脆弱性があります。 日付: 2024-01-14 作者: Elizeu Das Dores ベンダーホームページ: https://www.setorinformatica.com/ バージョン: 3.1 POC CVE-2024-24035 "hmessage" パラメータは、DOM ベースのクロスサイトスクリプティング XSS に対して脆弱です。...
CVE-2017-7038
CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 문서 구현 XSS 취약점 var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html'; var xhr = new XMLHttpReques...
CVE-2021-24891-Simulation
WordPress의 Elementor Website Builder 플러그인에서 발견된 CVE-2021-24891로 식별된 DOM 기반 교차 사이트 스크립팅XSS 취약점을 시뮬레이션하고 익스플로잇할 수 있는 실습형 컨테이너화된 랩 환경입니다. 📖 취약점 소개 이 랩은 WordPress용 Elementor 플러그인버전 3.4.8 이전의 DOM 기반 교차 사이트 스크립팅XSS 취약점을 시연합니다. 이 취약점은 Elementor 편집기의 클라이언트 측 코드가 URL의 해시...에서 데이터를 직접 읽고 적절한 삭제sanitization...
WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin All In One SEO Pack versions = 5.0.1.1...
WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin LearnPress versions = 4.4.7...
WordPress Ivory Search – WordPress Search Plugin plugin <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by @nacento in WordPress Plugin Ivory Search versions = 5.5.18...
WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.5...
WordPress Visitor Traffic Real Time Statistics plugin <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Visitors Traffic Real Time Statistics versions = 8.16...
CVE-2021-42558
CVE-2021-42558: MITRE Caldera における複数のクロスサイトスクリプティング Caldera バージョン =2.8.1 には、認証済みおよび未認証の攻撃者によって悪用される可能性のある、複数の反射型、格納型、自己型XSS脆弱性が含まれています。 ベンダーの開示: この脆弱性に関するベンダーの開示はこちらでご覧いただけます。 要件: この脆弱性には以下が必要です: 一部のXSSは有効なユーザー認証情報を必要とします 概念実証: 詳細および悪用手順は、このPDFでご覧いただけます。 追加情報: XSSベクター「1.1...
CVE-2026-97341
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-103909
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...
CVE-2026-103909
The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...
EUVD-2026-91920
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-97341
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting in all versions up to and including 8.16 . The root cause is insufficient input sanitization and output escaping when handling the 'X-Real-IP' HTTP header. Specifically, the wp_aja...
CVE-2026-92538
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...