VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

CVE-2021-42558

CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

NoXss

NoXss NoXss is a cross-site script vulnerability scanner supported reflected xss and dom-based xss. It's very fast and suitable for testing millions of urls. It has found some xss vulnerabilities in Bug Bounty program. Features Fast and suitable for testing millions of urls Support Dom-based xssu...

security-advisories

🔐 Security Advisories by Minhajul Taivin Welcome to the official repository of my published CVE disclosures. This repository contains detailed security advisories, proof-of-concept information, mitigation strategies, and technical analysis for vulnerabilities I have discovered. 📌 Published CVEs 1️⃣...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS This proof of concept, demostraste an security flaw of dom-bases XSS manipulating and using JQuery DOM Methods. eg:.append, .text,.html Payload i used: alert"Text: " + $"test".text; To test the vulnerability do the following: 1. Open and web console, on your browser and...

CVE-2017-7038

CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html';...

CVE-2024-28715

CVE-2024-28715 CVE ID CVE-2024-28715 PRODUCT DoraCMS Version DoraCMS v2.18 and before PROBLEM TYPE Dom-based XSS. DESCRIPTION Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the...

EUVD-2026-113714

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-118500

The Cool FormKit Lite – Advanced Form Builder for Elementor WordPress plugin (versions ≤ 2.7.9 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the _elementor_data.form_fields[].custom_id parameter. An attack...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...

CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-

Target:http://117.72.165.13:8888/ Github:https://github.com/201206030/novel Version:V3.5.0 Vulnerability Name:DOM-based Cross-Site Scripting XSS Vulnerability in novel V3.5.0 CWE-79 Vulnerability Type: DOM-based Cross-Site Scripting DOM-based XSS Discovery Date: 2025-11-02 Vulnerability Details:...

WordPress Cool FormKit Lite – Advanced Form Builder for Elementor plugin <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cool Formkit Lite versions = 2.7.9...

PoC-CVE-2024-24035

CVE-2024-24035 Title The SIL 3.1 is vulnerable to Cross Site Scripting XSS in the "hmessage" parameter. Date: 2024-01-14 Author: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Version: 3.1 POC CVE-2024-24035 The "hmessage" parameter is vulnerable to DOM Based Cross Site...

CVE-2026-118095

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42...

EUVD-2026-112878

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42...

CVE-2026-118095

The David Lingren Media LIbrary Assistant WordPress plugin (versions up to and including 3.42 ) is vulnerable to a DOM-Based Cross-Site Scripting (XSS) flaw. This issue stems from the improper neutralization of input during web page generation. While specific exploit details or a remediation patc...

CVE-2026-118095 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42...