4241 matches found
CVE-2017-7038
CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html';...
burp-dom-scanner
Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...
NoXss
NoXss NoXss is a cross-site script vulnerability scanner supported reflected xss and dom-based xss. It's very fast and suitable for testing millions of urls. It has found some xss vulnerabilities in Bug Bounty program. Features Fast and suitable for testing millions of urls Support Dom-based xssu...
PoC-CVE-2024-24035
CVE-2024-24035 Title The SIL 3.1 is vulnerable to Cross Site Scripting XSS in the "hmessage" parameter. Date: 2024-01-14 Author: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Version: 3.1 POC CVE-2024-24035 The "hmessage" parameter is vulnerable to DOM Based Cross Site...
CVE-2021-24891-Simulation
一个实践性的、容器化的实验室环境，用于模拟和利用 Elementor Website Builder WordPress 插件中的基于 DOM 的跨站脚本（XSS）漏洞，标识为 CVE-2021-24891。 📖 关于该漏洞 该实验室演示了 WordPress Elementor 插件（版本低于 3.4.8）中的一个基于 DOM 的跨站脚本（XSS） 漏洞。该漏洞的产生是因为 Elementor 编辑器的客户端代码直接从 URL 的哈希（...）中读取数据，并将其附加到页面的文档对象模型（DOM）中，而没有进行适当的清理。 攻击者可以构造一个恶意链接，在哈希片段中包含 JavaScrip...
burp-dom-scanner
Burp DOM Scanner これは、シングルページアプリケーションの再帰的なクローリングとスキャンを可能にするBurp Suiteの拡張機能です。 Chromiumブラウザを実行して、WebページのDOMベースのXSSをスキャンします。 また、クローリング中に発行されたすべてのリクエスト（XHR、fetch、websocketsなど）を収集し、BurpのProxy、Repeater、Intruderに転送することができます。 これにはnodeとDOMDigが必要です。 ダウンロード 最新のリリースはこちらからダウンロードできます。 インストール 1. nodeをインストールします ...
VDO.Ninja - DOM-Based Cross-Site Scripting
VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...
CVE-2024-30956
CVE-2024-30956 cf https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-based XSS HTML Injection vulnerability in TOWeb version 5 eg http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navigate to the url, the JS code is executed PS: src contains a copy ...
WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin All In One SEO Pack versions = 5.0.1.1...
WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin LearnPress versions = 4.4.7...
WordPress Ivory Search – WordPress Search Plugin plugin <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by @nacento in WordPress Plugin Ivory Search versions = 5.5.18...
WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.5...
WordPress Visitor Traffic Real Time Statistics plugin <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Visitors Traffic Real Time Statistics versions = 8.16...
CVE-2021-42558
CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...
CVE-2026-97341
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-103909
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...
CVE-2026-103909
The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...
EUVD-2026-91920
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-97341
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting in all versions up to and including 8.16 . The root cause is insufficient input sanitization and output escaping when handling the 'X-Real-IP' HTTP header. Specifically, the wp_aja...
CVE-2026-92538
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...