CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PHP Code Execution — WordPress Core Software: WordPress Core ≤ 7.0.2 all versions prior to 7.0.3 CVSS: 8.9 High CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation Authentication Required: None Pre-Auth User Interaction...

CVE-2020-11022

Así que así Así que, amigos, CVE-2020-11022 es una vulnerabilidad en jQuery por debajo de la versión 3.5.0 o superior. La vulnerabilidad CVE-2020-11022 en sí misma desencadena un XSS aprovechando la manipulación del DOM como .html, .append, y otras para ejecutar código XSS malicioso. 1. Verificar...

LavaDome

LavaDome 🌋️ A newLavaMoat tool for DOM nodes secured E ncapsulation ⚠️ EXPERIMENTAL WIP - USE AT YOUR OWN RISK learn more Demo Take a crack atLavaDome - visit the demo app, open the console, and do whatever in your power to steal the secret from within the LavaDome instance report your success...

findom-xss

FinDOM-XSS FinDOM-XSS 是一个工具，可以快速查找可能的/潜在的基于DOM的XSS漏洞。 安装 root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules 依赖项： LinkFinder 用法 要在目标上运行该工具，只需使用以下命令。 root@kitploit: $ ./findom-xss.sh https://domain.tld/about-us.html 这将对 domain.tld 运行该工具。...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a targe...

chromebackdoor

VIDEO Install Text V 3.0 Install Video OLD Binder guide Module guide Form grabber plugins Facebook MessengerSpy plugins Jabber Notifier/ Hide Panel Windows infection Rubber Ducky Payload Require: pip install crxmake wine32 Let's go root@kitploit: python chromebackdoor.py user: root pass: toor KAL...

VUL4J-59

jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...

jsprime

Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...

CVE-2026-18964 Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...

EUVD-2026-75931

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...

gha-lab-fb6df3d456

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of phpgt/Dom at commit...

PT-2026-90505

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

Linux Distros Unpatched Vulnerability : CVE-2026-88057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, a...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

React2shell-CVE-2025-55182-checker

CVE-2025-55182 React2Shell: Herramienta de Detección Herramientas de detección para encontrar componentes de servidor de React vulnerables en tu infraestructura. Inicio Rápido root@kitploit: Install dependencies pip3 install requests Version detection passive, safe for production python3 checker....

CVE-2026-84121

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Security component...

DEBIAN-CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...

CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...

CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...