CVE-2021-30573

CVE-2021-30573-PoC-Google-Chrome Google Chrome의 Use After Free 취약점 보고됨 Total Bug Bounty Reward: $6.000 이것은 다음에 대한 개념 증명PoC입니다: Google SecuritySeverity CVE. HIGH CVE-2021-30573 https://vulners.com/cve/CVE-2021-30573 Google 블로그 포스트:...

CVE-2022-30190

CVE-2022-30190 중요 패치 적용일: 2022년 6월 14일 보안 업데이트 CVE 보고서 HTML 파일은 대상 예제에 제공되어야 합니다 exploit.html 공격을 실행하는 쉬운 방법은 server.py를 실행하는 것입니다...

CVE-2023-33733

Reportlab v3.6.12의 CVE-2023-33733 이 랩은 CVE-2023-33733을 테스트하기 위해 설정되었습니다. 분석 과정 이 CVE에 대한 분석 과정은 메인 저장소의 PDF 파일에서 확인할 수 있습니다. 설정 및 실행 서버 설정 pip3 install -r requirements.txt 실행 python3 app.py 공격자 서버에 연결 서버 IP 주소에 연결하세요 http://ServerIP:4444 실행 후 다음과 같은 인터페이스가 나타납니다. 악성 HTML 파일을 업로드하여 RCE를 확인할 수 있습니다...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ -----------------------------124662954015823207281179831654 Content-Disposition: form-data; name="action" uploadugc -----------------------------124662954015823207281179831654 Content-Disposit...

CVE-2021-3395

CVE-2021-3395 推奨説明 Pryaniki 6.44.3 におけるクロスサイトスクリプティング XSS の脆弱性により、リモートの認証済みユーザーが任意のファイルをアップロードできます。誰かが添付ファイルを開くと、JavaScript コードが実行されます。 脆弱性タイプ クロスサイトスクリプティング XSS 製品のベンダー OOO Tekhnologii zashchity 影響を受ける製品コードベース PRYANIKY - 6.44.3 攻撃タイプ リモート 攻撃ベクトル この脆弱性を悪用するには、細工された HTML ファイルを開く必要があります。...

CheckFlashPlayerVersion

CheckFlashPlayerVersion 브라우저의 FlashPlayer 버전을 확인하여 익스플로잇 CVE-2016-7855에 취약한지 검사합니다. 사용법: 이 저장소를 클론한 후, Flash Player 버전을 확인하려는 브라우저에서 HTML 파일을 엽니다...

CVE-2022-44311

CVE-2022-44311 설명 html2xhtml v1.3은 procesador.c의 static void elmclosetreenodet nodo 함수에서 Out-Of-Bounds범위를 벗어난 읽기가 발생하는 것으로 발견되었습니다. 이 취약점으로 인해 공격자는 조작된 html 파일을 통해 민감한 파일에 접근하거나 서비스 거부DoS를 유발할 수 있습니다. 재현 취약점을 재현하려면 취약한 버전의 html2xhtmlv1.3을 다운로드하고 프로젝트를 컴파일합니다: wget...

cve_2013_3893_trigger.html

이 저장소에는 README가 없습니다...

Reachability-Check

Reachability Check 🌐 EN | TR Браузерный инструмент проверки доступности — тестирование сетевого соединения, правил межсетевого экрана и ограничений доступа. Один HTML-файл. Ноль зависимостей. Для запуска не требуется веб-сервер. Особенности Двойное измерение: HTTP Fetch + Image Ping через...

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

PT-2026-89108

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions 0.94 through 109.6 Description A stored cross-site scripting issue exists in the admin page upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the uploads/ pages/...

PT-2026-60099

Name of the Vulnerable Software and Affected Versions EasyAdmin affected versions not specified Description Stored Cross-Site Scripting XSS occurs because FileField and ImageField accept browser-executable file types by default. FileField applies no MIME or extension restrictions, while ImageFiel...

PT-2026-59357

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

GHSA-8GH5-QQH8-HQ3X Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

CVE-2026-36163

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file...

CVE-2026-36163: Improper Neutralization of Input During Web Page Generation

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file...

CVE-2026-13323

Vulnerability CVE-2026-13323 affects Open VSX Registry before 1.0.2. The /vscode/unpkg/ endpoint serves user-supplied HTML without CSP or Content-Disposition headers, enabling a publisher to upload a crafted VSIX and lure authenticated users to visit the URL. This inline rendering in the open-vsx...

CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/ and /file/:fileFolder/:id serve uploaded files using fileStream.piperes without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an...

CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/ and /file/:fileFolder/:id serve uploaded files using fileStream.piperes without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an...

CVE-2026-9053: Undefined Security Weakness

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element...