CVE-2025-27893

CVE-2025-27893: External Control of Assumed-Immutable Web Parameter in Archer Platform Description In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy...

CVE-2026-86776

A flaw was found in KeePass. An attacker can craft a malicious KDBX file that declares excessively large header field lengths. When a user opens this file, the application attempts to allocate gigabytes of memory, leading to resource exhaustion and causing the application to terminate. This...

CVE-2024-41505

CVE-2024-41505 CVE: CVE-2024-41505 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Vulnerability: Stored Cross-Site Scripting XSS Description: Stored XSS in the "Pessoas" section via the field "Profissão" when creating or editing a natural person. It is then executed...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload There are multiple unrestricted file uploads that result in the arbitrary execution of PHP code. Authenticated Vulnerable Pages: localhost/officeadmin/?pid=54&action=add root@kitploit: -----------------------------181967832439954202373233921976...

CVE-2023-49976

CVE-2023-49976 Customer Support System 1.0 - XSS Cross-Site Scripting Vulnerability in the "subject" at "ticketlist" Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor can insert JavaScri...

CVE-2024-57522

CVE-2024-57522 - Stored XSS Vulnerability in Users.php - SourceCodester Packers and Movers Management System 1.0 Description This repository contains a Proof of Concept PoC for a Stored Cross-Site Scripting XSS vulnerability in the Packers and Movers Management System 1.0 by SourceCodester. The...

CVE-2026-86776

KeePass versions 2.35 through 2.61.1 are affected by a memory exhaustion vulnerability in the ReadHeaderField function. The root cause is a failure to validate KDBX header field sizes before performing memory allocation. An attacker can craft a malicious KDBX file declaring excessive header field...

CVE-2022-24124

Preface Casdoor is a centralized single sign-on SSO authentication platform based on OAuth 2.0/OIDC ID CVE ID: CVE-2022-24124 CNPD ID: CNPD-202201-7304 Affected Versions Severity: High 7.5 HIGH POC/EXP: Publicly available Casdoor POC:...

CVE-2019-13051

Pi-Hole 4.3.2 Command Injection & PrivEsc CVE-2019-13051 Pi-Hole version 4.3.2 contains a patch to this vulnerability:https://github.com/pi-hole/AdminLTE/pull/974 A big thanks to the Pi-Hole dev team for their awesome project and for making it so easy to report this vulnerability! Executive Summa...

graphql-cop

GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...

CVE-2021-24545

CVE-2021-24545 This is an XSS vulnerability discovered in a plugin that is no longer distributed as a plugin. WordPress Plugin HTML Author Bio description XSS This vulnerability is caused by improper validation of the description parameter in /wp-admin/profile.php. A remote attacker can exploit...

CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user

CMSmadesimple Reflected XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in install/adduser.php of CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again in the My Preferences - Add...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS Stored XSS v2.3.2 Author: Sergio Description: Multiple Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. Attack Vectors: Scripting A...

CVE-2021-38603

CVE-2021-38603 A stored cross site scripting vulnerability is present on the Profile edit page in the Information: field for each user. http:///core/admin/profil.php Vulnerable Fields: Information: Once inserted, XSS can be triggered by visiting any page/article created by that particular user...

boko

boko Application Hijack Scanner for macOS boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application may use that have the potential to be backdoored. The tool...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

CVE-2023-33410

CVE-2023-33410 Minical 1.0.0 is vulnerable to CSV Injection. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Navigate to the Accounting module and click on Create New Customer. Step 2: Enter the payload in the Name field and Click on Create...

CVE-2025-26159

CVE-2025-26159 This script may only be used in authorized environments where explicit permission has been granted. The author is not responsible for any misuse, damage, or consequences resulting from the use of this script. This script decodes, filters, and extracts cookies as part of the...

CVE-2026-31891

SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw Vulnerability Class : SQL Injection CWE-89 Product : Cockpit CMS Core Edition Affected Version : 2.13.4 and likely all versions since the Aggregation Optimizer was introduced Docker Image Tested : cockpithq/cockpit:core-2.13.4...