CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...

CVE-2025-55182

CVE-2025-55182 - React2Shell Pre-authentication RCE in React Server Components. Summary of the CVE A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the react-server-dom-parcel,...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS This proof of concept, demostraste an security flaw of dom-bases XSS manipulating and using JQuery DOM Methods. eg:.append, .text,.html Payload i used: alert"Text: " + $"test".text; To test the vulnerability do the following: 1. Open and web console, on your browser and...

CVE-2025-55182-realistic-poc

CVE-2025-55182: React Server Components RCE A minimal proof of concept demonstrating the critical Remote Code Execution vulnerability in [email protected]. What is CVE-2025-55182? A pre-authentication RCE vulnerability in React Server Components that allows attackers to execute arbitrary cod...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

poc-CVE-2026-64638-

XSS2Shell — CVE-2026-64638 PoC WordPress Pre-Auth XSS → RCE exploit chain, based on research by pwn.ai published on ionsec.io. ⚠️ LEGAL WARNING : For EDUCATIONAL PURPOSES and AUTHORIZED TESTING only. Only use against systems you own or have explicit written permission to test. Lab Verification...

CVE-2025-5352

CVE-2025-5352 A stored Cross-Site Scripting XSS vulnerability has been identified in the Analytics component of lunary-ai/lunary. The issue arises because the NEXTPUBLICCUSTOMSCRIPT variable is injected directly into the DOM using dangerouslySetInnerHTML without proper sanitization or validation...

CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PHP Code Execution — WordPress Core Software: WordPress Core ≤ 7.0.2 all versions prior to 7.0.3 CVSS: 8.9 High CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation Authentication Required: None Pre-Auth User Interaction...

CVE-2020-11022

So here's the thing So here's the thing guys, CVE-2020-11022 is a vulnerability in jQuery versions below 3.5.0 or above, CVE-2020-11022 itself triggers an XSS by leveraging DOM Manipulation e.g., .html, .append, and others to execute malicious XSS code. 1. Verify jQuery Version: Make sure the...

LavaDome

LavaDome 🌋️ A newLavaMoat tool for DOM nodes secured E ncapsulation ⚠️ EXPERIMENTAL WIP - USE AT YOUR OWN RISK learn more Demo Take a crack atLavaDome - visit the demo app, open the console, and do whatever in your power to steal the secret from within the LavaDome instance report your success...

findom-xss

FinDOM-XSS FinDOM-XSS es una herramienta que te permite encontrar posibles y/o potenciales vulnerabilidades DOM based XSS de manera rápida. Instalación root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencias: LinkFinder Uso Para ejecutar la...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a targe...

chromebackdoor

VIDEO Install Text V 3.0 Install Video OLD Binder guide Module guide Form grabber plugins Facebook MessengerSpy plugins Jabber Notifier/ Hide Panel Windows infection Rubber Ducky Payload Require: pip install crxmake wine32 Let's go root@kitploit: python chromebackdoor.py user: root pass: toor KAL...

VUL4J-59

jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...