VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

burp-dom-scanner

Burp DOM 扫描器 这是一个 Burp Suite 的扩展，用于对单页应用进行递归爬取和扫描。 它会运行一个 Chromium 浏览器来扫描网页中的基于 DOM 的 XSS。 它还可以收集爬取期间发出的所有请求（XHR、fetch、websocket 等），允许将它们转发到 Burp 的 Proxy、Repeater 和 Intruder。 需要 node 和 DOMDig。 下载 最新版本可以在此下载。 安装 1. 安装 node 2. 安装 DOMDig 3. 下载并加载扩展 4. 在扩展的 UI 中设置 node 可执行文件的路径以及 domdig.js 的路径。 扫描引擎...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

NoXss

NoXss NoXss는 반사형 XSS와 DOM 기반 XSS를 지원하는 크로스사이트 스크립트 취약점 스캐너입니다. 매우 빠르며 수백만 개의 URL을 테스트하는 데 적합합니다. 버그 바운티 프로그램에서 일부 XSS 취약점을 발견했습니다. 기능 빠르며 수백만 개의 URL 테스트에 적합 DOM 기반 XSSChrome 또는 Phantomjs 사용 및 반사형 XSS 지원 현재 인젝션 위치에 기반한 8개의 페이로드만 사용 퍼징하지 않음, 더 정확하고 빠름 비동기 요청gevent 사용 및 멀티 프로세싱 단일 URL, 파일 및 Burpsuit...

CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-

Цель:http://117.72.165.13:8888/ Github:https://github.com/201206030/novel Версия:V3.5.0 Название уязвимости:Уязвимость межсайтового скриптинга на основе DOM XSS в novel V3.5.0 CWE-79 Тип уязвимости: Межсайтовый скриптинг на основе DOM DOM-based XSS Дата обнаружения: 2025-11-02...

CVE-2017-7038

CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 XSS-Schwachstelle in der Dokumentimplementierung root@kitploit: var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new...

CVE-2024-28715

CVE-2024-28715 CVE-ID CVE-2024-28715 PRODUKT DoraCMS Version DoraCMS v2.18 und früher PROBLEMTYP DOM-basiertes XSS. BESCHREIBUNG Eine Cross-Site-Scripting-Sicherheitslücke in DOraCMS v.2.18 und früher ermöglicht es einem entfernten Angreifer, beliebigen Code über die markdown0-Funktion im Endpunk...

PoC-CVE-2024-24035

CVE-2024-24035 Título O SIL 3.1 é vulnerável a Cross Site Scripting XSS no parâmetro "hmessage". Data: 2024-01-14 Autor: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Versão: 3.1 POC CVE-2024-24035 O parâmetro "hmessage" é vulnerável a Cross Site Scripting XSS baseado em DOM...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS Questa prova di concetto dimostra una falla di sicurezza di XSS basata sul DOM, manipolando e utilizzando i metodi DOM di JQuery. esempio: .append, .text, .html Payload che ho usato: root@kitploit: alert"Text: " + $"test".text; Per testare la vulnerabilità, segui i...

findom-xss

FinDOM-XSS FinDOM-XSS è uno strumento che ti permette di trovare possibili e/o potenziali vulnerabilità DOM XSS in modo rapido. Installazione root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dipendenze: LinkFinder Utilizzo Per eseguire lo strumento su ...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a targe...

CVE-2026-78615

A Reflected DOM-based XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in an authenticated user's browser via a specially crafted URL. The CVSS 4.0 base score is 4.6 (MEDIUM) , with high privileges and active user interaction requir...

CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Versione immagine: 267r Livello di patch: 639 Vulnerabilità: DOM Based XSS Description Il software di gestione CAE Learning Space Enterprise è vulnerabile a un attacco DOM Based XSS. Un attacco DOM Based XSS...

CVE-2021-42558

CVE-2021-42558: Mehrere Cross-Site-Scripting-Schwachstellen in MITRE Caldera Caldera Versionen =2.8.1 enthält mehrere reflektierte, persistente und Self-XSS-Schwachstellen, die sowohl von authentifizierten als auch nicht authentifizierten Angreifern ausgenutzt werden können. Offenlegung durch den...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Exploração de XSS DOM no Roundcube Webmail 📋 Informações da Exploração Título da Exploração: XSS DOM no Roundcube Webmail via href em SVG CVE-2026-25916 Autor: Mohammed Idrees Banyamer Contato: GitHub @mbanyamer | Instagram @banyamersecurity País: Jordânia Data: 9 de fevereiro de...

CVE-2021-24891-Simulation

Um ambiente de laboratório prático e containerizado para simular e explorar uma vulnerabilidade de Cross-Site Scripting XSS baseada em DOM no plugin Elementor Website Builder para WordPress, identificada como CVE-2021-24891. 📖 Sobre a Vulnerabilidade Este laboratório demonstra uma vulnerabilidade...

security-advisories

🔐 Avisos de Segurança por Minhajul Taivin Bem-vindo ao repositório oficial das minhas divulgações de CVE publicadas. Este repositório contém avisos de segurança detalhados, informações de prova de conceito, estratégias de mitigação e análise técnica para vulnerabilidades que descobri. 📌 CVEs...

CVE-2024-30956

CVE-2024-30956 veja https://www.lauyan.com/en/toweb-updates.htmliyFEw37D Vulnerabilidade de injeção HTML XSS baseado em DOM na versão 5 por exemplo http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navegue até a URL, o código JS é executado PS: src contém...

CVE-2026-18328

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...