galer

galer root@kitploit: /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol...

galer

galer root@kitploit: /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 크롤인을 통해 HTML 속성에서 URL을 가져오는 빠른 도구입니다. @omespino의 트윗에서 영감을 받았으며, Chrome DevTools Protocol을 통해 JavaScript를 평가하여 src, href, url, action 값을 추출할 수 있습니다. 참고 자료 설치 바이너리에서 소스에서 GitHub에서 사용법 기본 사용법 플래그 예제 단일 URL 목록에서 URL Stdin에서...

CVE-2026-19727

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-19727

CVE-2026-19727 is an XSS (targeting HTML attributes) vulnerability in the Yordam Information Technology Consulting Library Information and Document Automation Program , caused by improper neutralization of input during web page generation. The issue affects versions before v22.2 and is rated CVSS...

EUVD-2026-71213

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-83547

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-70047

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83547

Xpro Addons (WordPress plugin) versions 1.6.0 through 1.7.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain widget settings are not properly escaped before being rendered within HTML attributes . An attacker with the Contributor role or higher can inject malic...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-49452

A flaw was found in WeasyPrint, a tool designed to create PDF documents from web content. When processing untrusted HTML with presentational hints enabled, WeasyPrint embeds unescaped HTML attribute values directly into CSS declarations. This vulnerability allows a remote attacker to inject...

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

CVE-2026-15233

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

JLSEC-2026-1161 GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability...

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity...

CVE-2026-13458

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-51744

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-13458 GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-60354

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Description Drupal core contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. The XSS filter does not...

YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the...

CVE-2026-58472

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity...