NoXss

NoXss NoXss ist ein Cross-Site-Scripting-Schwachstellenscanner, der reflektiertes XSS und DOM-basiertes XSS unterstützt. Er ist sehr schnell und geeignet, um Millionen von URLs zu testen. Er hat einige XSS-Schwachstellen im Bug-Bounty-Programm gefunden. Features Schnell und geeignet zum Testen vo...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

CVE-2024-30956

CVE-2024-30956 siehe https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-basiertes XSS HTML-Injection-Schwachstelle in TOWeb Version 5 z. B. http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP Rufen Sie die URL auf, d...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

burp-dom-scanner

Burp DOM Scanner É uma extensão do Burp Suite que permite rastreamento e escaneamento recursivo de Single Page Applications. Ele executa um navegador Chromium para escanear a página web por XSS baseado em DOM. Ele também pode coletar todas as requisições XHR, fetch, websockets, etc emitidas duran...

CVE-2026-102774

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-101920

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment href attribute inside comment content' parameter in all versions up to, and including, 5.2.12 due to insufficient input...

CVE-2026-102774

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.12.1 . The flaw exists in the Community Post Content due to insufficient input sanitization and output escaping. Specificall...

CVE-2026-102774 SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-96277

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment href attribute inside comment content' parameter in all versions up to, and including, 5.2.12 due to insufficient input...

CVE-2026-101920

The Molongui Authorship WordPress plugin (versions up to and including 5.2.12 ) is vulnerable to Unauthenticated Stored DOM-Based Cross-Site Scripting . The flaw exists in the 'comment (href attribute inside comment content)' parameter due to insufficient input sanitization and output escaping. U...

CVE-2026-101920 Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment href attribute inside comment content' parameter in all versions up to, and including, 5.2.12 due to insufficient input...

CVE-2021-42558

CVE-2021-42558: Mehrere Cross-Site-Scripting-Schwachstellen in MITRE Caldera Caldera Versionen =2.8.1 enthält mehrere reflektierte, persistente und Self-XSS-Schwachstellen, die sowohl von authentifizierten als auch nicht authentifizierten Angreifern ausgenutzt werden können. Offenlegung durch den...

CVE-2026-100161 Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-89100

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 4.0.17 . The root cause is insufficient input sanitization and output escaping specifically via the '#response' URL Fragment . This allows unau...

CVE-2026-103912

The JetFormBuilder WordPress plugin (versions 3.6.6 and below ) is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the parameter. Unauthenticated attackers can inject arbitrary web scripts by tricking ...

CVE-2026-103912 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PoC-CVE-2024-24035

CVE-2024-24035 Titel Der SIL 3.1 ist anfällig für Cross-Site-Scripting XSS im Parameter "hmessage". Datum: 2024-01-14 Autor: Elizeu Das Dores Hersteller-Homepage: https://www.setorinformatica.com/ Version: 3.1 POC CVE-2024-24035 Der Parameter "hmessage" ist anfällig für DOM-basiertes...

CVE-2022-45472

CVE-2022-45472 DOM-basiertes XSS Software: CAE Learning Space Enterprise mit Intuity-Lizenz Image-Version: 267r Patch-Level: 639 Sicherheitslücke: DOM-basiertes XSS Beschreibung Die Verwaltungssoftware CAE Learning Space Enterprise ist anfällig für einen DOM-basierten XSS-Angriff. Ein DOM-basiert...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS Dieser Proof of Concept demonstriert eine Sicherheitslücke von DOM-basiertem XSS durch Manipulation und Verwendung von jQuery DOM-Methoden. z.B.:.append, .text,.html Verwendeter Payload: alert"Text: " + $"test".text; So testen Sie die Schwachstelle: 1. Öffnen Sie die...