cve_2013_3893_trigger.html

इस रिपॉजिटरी में README नहीं है।...

CVE-2021-30573

CVE-2021-30573-PoC-Google Chrome Vulnerabilidade Use After Free do Google Chrome reportada Recompensa Total do Bug Bounty: $6.000 Esta é a Prova de Conceito para: Google SecuritySeverity CVE. ALTA CVE-2021-30573 https://vulners.com/cve/CVE-2021-30573 Postagem do blog do Google:...

CVE-2021-3395

CVE-2021-3395 Vorgeschlagene Beschreibung Eine Cross-Site-Scripting XSS-Schwachstelle in Pryaniki 6.44.3 ermöglicht es entfernten authentifizierten Benutzern, eine beliebige Datei hochzuladen. Der JavaScript-Code wird ausgeführt, wenn jemand den Anhang besucht. Schwachstellentyp...

CVE-2023-33733

CVE-2023-33733 su Reportlab v3.6.12 Questo laboratorio è stato allestito per testare CVE-2023-33733. Processo di analisi Puoi vedere il nostro processo di analisi su questa CVE nel file PDF nella repository principale. Configurazione ed esecuzione Server Configurazione root@kitploit: pip3 install...

CVE-2022-44311

Descrizione per CVE-2022-44311 È stato scoperto che html2xhtml v1.3 contiene una lettura fuori dai limiti nella funzione static void elmclosetreenodet nodo in procesador.c. Questa vulnerabilità consente agli aggressori di accedere a file sensibili o causare un Denial of Service DoS tramite un fil...

Reachability-Check

Controllo di Raggiungibilità 🌐 EN | TR Controllo di raggiungibilità basato su browser — testa la connettività di rete, le regole del firewall e le restrizioni di accesso. File HTML singolo. Zero dipendenze. Nessun server web necessario per eseguirlo. Caratteristiche Doppia misurazione: HTTP Fetch...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/X...

CVE-2022-30190

CVE-2022-30190 WICHTIG Gepatcht ab: Sicherheitsupdates vom 14. Juni 2022 CVE Report Die HTML-Datei muss dem Ziel bereitgestellt werden, z.B. exploit.html Eine einfache Möglichkeit, den Angriff auszuführen, ist das Ausführen von server.py...

CheckFlashPlayerVersion

CheckFlashPlayerVersion ब्राउज़र के FlashPlayer संस्करण की जाँच करें कि क्या यह CVE-2016-7855 एक्सप्लॉइट के लिए असुरक्षित है उपयोग: इस रिपॉजिटरी को क्लोन करें और फिर उस ब्राउज़र में html फ़ाइल खोलें जहाँ आप Flash Player संस्करण की जाँच करना चाहते हैं...

PT-2026-59357

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

GHSA-8GH5-QQH8-HQ3X Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

CVE-2026-13323

Vulnerability CVE-2026-13323 affects Open VSX Registry before 1.0.2. The /vscode/unpkg/ endpoint serves user-supplied HTML without CSP or Content-Disposition headers, enabling a publisher to upload a crafted VSIX and lure authenticated users to visit the URL. This inline rendering in the open-vsx...

CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/ and /file/:fileFolder/:id serve uploaded files using fileStream.piperes without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an...

CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/ and /file/:fileFolder/:id serve uploaded files using fileStream.piperes without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an...

PT-2026-42720

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element...

CVE-2026-45315

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHEDIR/audio/transcriptions/.. The /cache/path route serve...

EUVD-2026-30656

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHEDIR/audio/transcriptions/.. The /cache/path route serve...

CVE-2026-34429

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF8...

CVE-2026-41467

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the...

CVE-2026-40487

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the Content-Type header. The uploaded files are then served by nginx with a...