XSScope

Go beyond the alert XSScope is one of the most advanced GUI Framework for XSS Clientside attacks. It can perform different XSS attack and HTML Injection in real time. Features Perform XSS botnet attacks. Every victim who is affected by XSS payload in the webserver, will contantly bind the payload...

CVE-2023-45540

HTML-Injection...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension HTML tag: root@kitploit: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

CVE-2020-14965

CVE-2020-14965 root@kitploit: ██╗ ██╗████████╗███╗ ███╗██╗ ██╗███╗ ██╗ ██╗███████╗ ██████╗████████╗██╗ ██████╗ ███╗ ██╗ ██║ ██║╚══██╔══╝████╗ ████║██║ ██║████╗ ██║ ██║██╔════╝██╔════╝╚══██╔══╝██║██╔═══██╗████╗ ██║ ███████║ ██║ ██╔████╔██║██║ ██║██╔██╗ ██║ ██║█████╗ ██║ ██║ ██║██║ ██║██╔██╗ ██║...

CVE-2024-54160-Opensearch-HTML-And-Injection-Stored-XSS

CVE-2024-54160-Opensearch-Inyección de HTML + XSS Almacenado Se descubrió que el plugin de Opensearch llamado "reports" era vulnerable a la inyección de HTML en la versión 2.18.0. La funcionalidad de informes permitía a los usuarios almacenar HTML en el encabezado y pie de página al crear una nue...

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. id: CVE-2018-7196 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

CVE-2022-23808

Exploit de phpMyAdmin Título del Exploit : phpMyAdmin 5.1.1 - XSS Cross-site Scripting Autor del Exploit : Dipak Panchal @th3.d1p4k Página principal del proveedor : https://www.phpmyadmin.net Enlace del software : https://www.phpmyadmin.net/files/5.1.1/ Versiones afectadas : Las versiones de...

CVE-2023-28467

MyBB 1.8.33 User CP email persistent XSS root@kitploit: - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Solution Upgrade MyBB version 1.8.34 or higher...

leaflet-cve-2025-69993

CVE-2025-69993 — Leaflet bindPopup 中的 XSS 漏洞 Leaflet = 1.9.4 中存在跨站脚本攻击（XSS）漏洞。 bindPopup 方法将用户提供的输入直接渲染为原始 HTML 而不进行清理，从而允许任意 JavaScript 代码执行。 仓库结构 ADVISORY.md — 完整安全公告，包含漏洞详情、影响分析及推荐缓解措施 leaflet-xss-poc/ — Angular 应用，在真实场景中演示该漏洞（用户表单输入直接传递给 bindPopup） 快速开始 root@kitploit: cd leaflet-xss-poc npm...

CVE-2025-53693

CVE-2025-53693: Envenenamiento de caché HTML El controlador XAML, ubicado en /-/xaml/, expone varios controles a los que se puede acceder sin autenticación. El AjaxScriptManager dentro de estos controles permite la ejecución de métodos mediante reflexión. El método AddToCache puede ser abusado pa...

CVE-2021-24884

CVE-2021-24884 XSS2RCE in Formidable 4.09.04 Formidable 4.09.04 allowed to inject certain HTML Tags like ,,, and . This could allow an unauthenticated, remote attacker to exploit a HTML-injection by injecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2023-47119

Table of contents CVE-2023-47119 Detailed analysis POC Escalation ? LAB Setup CVE-2023-47119 A POC for CVE-2023-47119 which is a vulnerability affecting Discourse versions prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches. Some links can...

Leantime-POC

Leantime-POC CVE-2024-27474, CVE-2024-27476, CVE-2024-27477 描述 在 Leantime 目标导向项目管理系统的 3.0.6 版本中发现了以下漏洞。 CVE-2024-27474 一个跨站请求伪造（CSRF）漏洞，触发后会创建并提升一个账户的权限至管理员角色。 CVE-2024-27476 一个 HTML 注入漏洞，允许攻击者通过 href 属性或锚标签向应用程序注入恶意 HTML 代码。在我的概念验证（POC）中，我利用它重定向“受害者”（也就是我自己）到一个攻击者控制的登录页面，在那里可能会窃取他们的凭据。...

CVE-2024-23998

Another Redis Desktop Manager PoC CVE-2024-23998 漏洞的验证概念。 1. 漏洞概述： 漏洞主题：通过 XSS 实现本地代码执行 受影响版本：=\ 2. Font selection is orderly. It is suggested to choose English font first and then font in your language\ 3. When the system font list cannot be loaded in some exceptional cases, you can enter the...

LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

Título del Exploit: LetterPress CLICK THIS" en el campo de entrada Mensaje de Campaña HTML y haz clic en Guardar Campaña. 2. Visualiza la campaña y haz clic en el hipervínculo "CLICK THIS"; te redirigirá al sitio de terceros. Ej.: evil.com...

CVE-2024-26521

CVE-2024-26521 CE-Phoenix-v1.0.8.20 HTML 注入漏洞 登录页面 正如我们所见，这里有一个登录页面，任何人都能看出该应用程序中存在 HTML 注入漏洞。 基本上，该应用程序中的所有 PHP 文件都保存在此位置，如下方图片所示！ HTML 注入代码 PoC - 概念验证图片 有效载荷 payloads.txt PoC 视频 https://github.com/hackervegas001/CVE-2024-26521/assets/109858877/a7e8c1a1-a0e6-412a-ab91-da4d3974db77...