jquery-cve-2022-31160

es-define-property Object.defineProperty, but not IE 8's broken one. Example const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty assert.equal$defineProperty, false...

xss_vulnerability_challenges

XSS 漏洞场景（挑战） 本仓库是一个 Docker 化的 PHP 应用程序，包含了一些 XSS 漏洞挑战。 挑战背后的思路包括： JavaScript 验证绕过 HTML 实体绕过 WAF 绕过 黑名单验证绕过 基础 XSS 验证绕过 利用双层编码绕过 WAF 以利用 XSS 通过绕过转义字符利用 XSS 使用 Docker 快速开始 使用 Docker Hub（最快）： 1. 要访问这些挑战，你需要安装 Docker。 2. 运行以下命令从 Docker Hub 拉取并运行镜像： sudo docker run -d -p 9003:80...

CVE-2026-100630

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...

CVE-2026-100630 AVideo Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...

CVE-2026-100630 AVideo Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...

EUVD-2026-87724

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...

CVE-2026-56736

The open-source FAQ web application phpMyFAQ is vulnerable to a stored cross-site scripting (XSS) flaw in versions prior to 4.2.0-alpha . The root cause is an HTML entity bypass where the html_entity_decode() function converts entities into executable HTML after strip_tags() has already processed...

CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

EUVD-2026-78928

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-81896: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

PT-2026-92130

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/single pages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-18964

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...

PT-2026-89752

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...

CVE-2026-84219

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

EUVD-2026-72065

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

CVE-2026-84219

The Kirki WordPress plugin (versions before 6.3.0 , specifically identified as 6.2.1-6.2.5 in some records) is vulnerable to Unauthenticated Stored XSS . The root cause is that the plugin fails to restrict the various spellings of HTML entities it decodes during rendering. This allows an unauthen...

CVE-2026-84219 Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

CVE-2026-84219 Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...