burp-dom-scanner

Burp DOM 扫描器 这是一个 Burp Suite 的扩展，用于对单页应用进行递归爬取和扫描。 它会运行一个 Chromium 浏览器来扫描网页中的基于 DOM 的 XSS。 它还可以收集爬取期间发出的所有请求（XHR、fetch、websocket 等），允许将它们转发到 Burp 的 Proxy、Repeater 和 Intruder。 需要 node 和 DOMDig。 下载 最新版本可以在此下载。 安装 1. 安装 node 2. 安装 DOMDig 3. 下载并加载扩展 4. 在扩展的 UI 中设置 node 可执行文件的路径以及 domdig.js 的路径。 扫描引擎...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a target, just use the...

findom-xss

FinDOM-XSS FinDOM-XSS 是一个工具，可以快速查找可能的/潜在的基于DOM的XSS漏洞。 安装 $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules 依赖项： LinkFinder 用法 要在目标上运行该工具，只需使用以下命令。 $ ./findom-xss.sh https://domain.tld/about-us.html 这将对 domain.tld 运行该工具。 URLs也可以管道输入到findom-xss并进行扫描。例如： $ cat urls.txt |...

Hoppscotch <= 2026.2.1 - Open Redirect

Hoppscotch = 2026.2.1 is vulnerable to a DOM-based open redirect on the /enter page. The redirect query parameter is passed directly to windowz location.href with no origin validation. Requires one additional query parameter to trigger. Exploited via a crafted URL such as...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Explotación de XSS DOM en Roundcube Webmail 📋 Información del Exploit Título del Exploit: XSS DOM en Roundcube Webmail mediante href SVG CVE-2026-25916 Autor: Mohammed Idrees Banyamer Contacto: GitHub @mbanyamer | Instagram @banyamersecurity País: Jordania Fecha: 9 de febrero de...

CVE-2024-28715

CVE-2024-28715 CVE 编号 CVE-2024-28715 产品 DoraCMS 版本 DoraCMS v2.18 及更早版本 问题类型 基于DOM的XSS 描述 DOraCMS v.2.18 及更早版本中存在跨站脚本漏洞，允许远程攻击者通过 /app/public/apidoc/oas3/wrap-components/markdown.jsx 端点中的 markdown0 函数执行任意代码。 使用方式 https://target-site/static/apidoc/index.html?url=https://your-site/POC.yaml...

CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-

Target:http://117.72.165.13:8888/ Github:https://github.com/201206030/novel Version:V3.5.0 漏洞名称：novel V3.5.0 中的基于 DOM 的跨站脚本（XSS）漏洞（CWE-79） 漏洞类型：基于 DOM 的跨站脚本（DOM-based XSS） 发现日期：2025-11-02 漏洞详情： novel（V3.5.0）是一个基于 Spring Boot 3 + Vue 3 的小说阅读平台，其书籍评论模块存在基于 DOM 的 XSS 漏洞。问题在于对用户提交的评论内容缺乏充分的验证/编码：...

Yonyou U8 13.0 - Cross-Site Scripting

Yonyou U8 13.0 contains a DOM-based cross-site scripting vulnerability via the component /u8sl/WebHelp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

security-advisories

🔐 Minhajul Taivin 的安全公告 欢迎来到我发布的CVE漏洞公告的官方仓库。 本仓库包含我所发现漏洞的详细安全公告、概念验证信息、缓解策略以及技术分析。 📌 已发布的CVE 1️⃣ CVE-2025-63892 —— SourceCodester Student Grades Management System 中的存储型XSS漏洞 📄 安全公告：CVE-2025-63892.md 教室描述字段中的存储型XSS漏洞可导致任意JavaScript执行、会话劫持以及用户冒充。 2️⃣ CVE-2025-63883 —— E-commerce...

CVE-2026-79816

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting XSS attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-79816

A DOM-based cross-site scripting (XSS) vulnerability exists in the client interface of HPE Networking ClearPass Policy Manager . This flaw allows an unauthenticated remote attacker to execute arbitrary script code within a victim's browser context while using the affected client interface. No spe...

EUVD-2026-93902

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting XSS attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute...

CVE-2026-79816 Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting XSS attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute...

CVE-2026-79816 Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting XSS attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute...

EUVD-2026-93781

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

PT-2026-107214

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting XSS attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute...

PT-2026-106853

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...