CVE-2026-55566 Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

EUVD-2026-67845

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566 Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566

Yamcs , a mission control framework, is affected by a DOM XSS in the /ext URL route (affected versions prior to 5.12.8 and 5.13.2 ). The root cause is that attacker-controlled data in files extension.matcher.ts, extension.component.ts, and app.component.ts is rendered via innerHTML without valida...

CVE-2020-11022-CVE-2020-11023

CVE-2020-11022 CVE-2020-11023 Dans les versions de jQuery supérieures ou égales à 1.2 et antérieures à 3.5.0, le passage de HTML provenant de sources non fiables - même après l'avoir nettoyé - à l'une des méthodes de manipulation du DOM de jQuery c'est-à-dire .html, .append et autres peut exécute...

Chromium: CVE-2026-79271 Information leak in DOM

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-79179 Incorrect authorization in DOM

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-78975 Incorrect authorization in DOM

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

gha-lab-f1c8785cc8

Moderne DOM-API Dieses Projekt basiert auf dem nativen DOMDocument von PHP und bietet Zugriff auf moderne DOM-APIs, wie man es von clientseitigem Code im Browser gewohnt ist. Die Durchführung von DOM-Manipulationen im serverseitigen Code verbessert die Art und Weise, wie dynamische Seiten erstell...

CVE-2025-5352

CVE-2025-5352 È stata identificata una vulnerabilità di Cross-Site Scripting XSS memorizzato nel componente Analytics di lunary-ai/lunary. Il problema deriva dal fatto che la variabile NEXTPUBLICCUSTOMSCRIPT viene iniettata direttamente nel DOM utilizzando dangerouslySetInnerHTML senza una corret...

CVE-2024-28715

CVE-2024-28715 CVE-ID CVE-2024-28715 PRODUKT DoraCMS Version DoraCMS v2.18 und früher PROBLEMTYP DOM-basiertes XSS. BESCHREIBUNG Eine Cross-Site-Scripting-Sicherheitslücke in DOraCMS v.2.18 und früher ermöglicht es einem entfernten Angreifer, beliebigen Code über die markdown0-Funktion im Endpunk...

CVE-2026-43735

CVE-2026-43735 WebKit divulgazione di informazioni cross-origin. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principio Quando la pagina padre utilizza per attivare la navigazione di frammento di un iframe cross-origin, l'iframe riceve NavigateEvent.sourceElement che è l'elemento...

LavaDome

LavaDome 🌋️ Uma nova ferramentaLavaMoat para E ncapsulamento s eguro de nós do DOM ⚠️ EXPERIMENTAL WIP - USE POR SUA CONTA E RISCO saiba mais Demo Tente quebrar oLavaDome - visite o aplicativo de demonstração, abra o console e faça tudo ao seu alcance para roubar o segredo de dentro da instância...

PoC-CVE-2024-24035

CVE-2024-24035 Título O SIL 3.1 é vulnerável a Cross Site Scripting XSS no parâmetro "hmessage". Data: 2024-01-14 Autor: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Versão: 3.1 POC CVE-2024-24035 O parâmetro "hmessage" é vulnerável a Cross Site Scripting XSS baseado em DOM...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS Questa prova di concetto dimostra una falla di sicurezza di XSS basata sul DOM, manipolando e utilizzando i metodi DOM di JQuery. esempio: .append, .text, .html Payload che ho usato: root@kitploit: alert"Text: " + $"test".text; Per testare la vulnerabilità, segui i...

CVE-2026-82090

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

CVE-2025-55182-analysis

1. Panoramica della vulnerabilità Negli ultimi giorni, c'è stato un gran parlare di una vulnerabilità RCE di deserializzazione in React, con il CVSS ufficiale che ha raggiunto il massimo di 10.0, alla pari del Log4j di qualche anno fa. Immediatamente si sono diffuse voci che la definivano il...

findom-xss

FinDOM-XSS FinDOM-XSS è uno strumento che ti permette di trovare possibili e/o potenziali vulnerabilità DOM XSS in modo rapido. Installazione root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dipendenze: LinkFinder Utilizzo Per eseguire lo strumento su ...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a targe...

chromebackdoor

VIDEO Install Text V 3.0 Install Video OLD Binder guide Module guide Form grabber plugins Facebook MessengerSpy plugins Jabber Notifier/ Hide Panel Windows infection Rubber Ducky Payload Require: pip install crxmake wine32 Let's go root@kitploit: python chromebackdoor.py user: root pass: toor KAL...