dalfox

Looking for the Go v2.x version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy, and the migration guide for what changed in v3. Dalfox is a powerful open-source tool that...

AwesomeXSS

AwesomeXSS This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue. Awesome contents Challenges Reads & Presentations Tools Mind maps DOM XSS Payloads Polyglots Tags and event handlers Context breaking HTML context Attribute context...

CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

EUVD-2026-69234

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

EUVD-2026-69220

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2021-39512-BigTreeCMS-v4.4.14-AccountTakeOver

BigTreeCMS-v4.4.14-Unauthenticated-CSRF-AccountTakeOver Unauthenticated CSRF Account TakeOver in BigTreeCMS v4.4.14 All searchable modules in the admin panel of BigTreeCMS v4.4.14 are vulnerable to reflected DOM-XSS via the URI. Search queries are reflected on the page without proper sanitization...

CVE-2025-55182

Understanding React Server Components and the Flight Protocol React Server Components is a feature introduced in React 19 that allows components to be rendered on the server instead of in the client's browser. The server can handle complex computational tasks while only sending the rendered resul...

react2shell-rce-autobot

🔍 React2Shell Dork Scanner 🚨 Tentang Kerentanan React2Shell adalah kerentanan Remote Code Execution RCE kritikal yang mempengaruhi: Target| Versi Vulnerable ---|--- ⚛️ react-server-dom-webpack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️ react-server-dom-turbopack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️...

CVE-2026-84125

A flaw was found in Firefox. A use-after-free vulnerability in the DOM: Core & HTML component could allow a remote attacker to execute arbitrary code...

CVE-2026-84139

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84140

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84133

Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84137

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84125

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84129

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84124

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-84121

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-84119

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2017-7038

CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability root@kitploit: var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayloa...

CVE-2026-84140

CVE-2026-84140 is a site isolation issue in the DOM: Navigation component of Mozilla Firefox . The vulnerability was fixed in Firefox 155 and Firefox ESR 153.2 . Site isolation issues in Firefox typically involve cross-site information leakage where the DOM Navigation component fails to properly ...