CVE-2020-28414

CVE-2020-28414 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2025-65754

CVE-2025-65754 : Stored XSS in Algernon 1.17.4 Description Algernon v1.17.4 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload into a filename. Affected Project : Algernon - 1.17.4 Project maintainer : Alexander F. Rødseth...

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...

wwwgrep

WWWGrep OWASP Foundation Web Respository Author: Mark Deen & Aditi Mohan Introduction WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed...

CVE-2022-42097

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Comment . Attack Vectors: The attacker must post something on the "comment" and insert the XSS payload at the "comment" input, and...

CVE-2022-42095

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Page content. Attack Vectors: The attacker must post something on the "Page content" and insert the XSS payload at the "Body" input,...

CVE-2023-49539

CVE-2023-49539 Book Store Management System v1.0 - Cross-site scripting XSS vulnerability in "index.php/category" - vulnerable field: "Category Name" Description : Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in "/bsmsci/index.php/category"...

CVE-2022-39197-patch

CVE-2022-39197 patch CVE-2022-39197 Cobalt Strike XSS 漏洞的一个临时补丁 通过 hook javax.swing.plaf.basic.BasicHTML的isHTMLString方法来禁用swing的html支持 PS: 部分依赖html的页面无法正常渲染例如 关于页面 使用方法 将 patch.jar 放入cobaltstrike启动目录下 在cobaltstrike启动参数中加入javaagent 启用补丁 -javaagent:patch.jar 启动cobaltstrike 输出Successfully Patched...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2026-55649

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another...

CVE-2006-3392

CVE-2006-3392 Description Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are...

CVE-2026-55649 GeoNode has Stored XSS in Documents metadata abstract field

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another...

CVE-2026-55649 GeoNode has Stored XSS in Documents metadata abstract field

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another...

CVE-2021-3395

CVE-2021-3395 Suggested description A cross-site scripting XSS vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment. Vulnerability Type Cross Site Scripting XSS Vendor of Product OOO...

cve-2020-11023-demonstration

Jquery XSS - CVE-2020-11023 This is a demonstration of reproducing CVE-2020-11023. Source is mainly from this blog post. Reproduce Install npm dependencies with npm install, jQuery 3.4.1 is included as a dependency. Run the project with for example live server for vs code. The site contains two...

Leantime-POC

Leantime-POC CVE-2024-27474, CVE-2024-27476, CVE-2024-27477 Description The following vulnerabilities were identified in version 3.0.6 of the Leantime goals focused project management system. CVE-2024-27474 A cross-site request forgery CSRF vulnerability which, when triggered, would create and...

CVE-2026-123851

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters...

CVE-2026-123840

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension HTML tag: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

CVE-2020-14965

CVE-2020-14965 ██╗ ██╗████████╗███╗ ███╗██╗ ██╗███╗ ██╗ ██╗███████╗ ██████╗████████╗██╗ ██████╗ ███╗ ██╗ ██║ ██║╚══██╔══╝████╗ ████║██║ ██║████╗ ██║ ██║██╔════╝██╔════╝╚══██╔══╝██║██╔═══██╗████╗ ██║ ███████║ ██║ ██╔████╔██║██║ ██║██╔██╗ ██║ ██║█████╗ ██║ ██║ ██║██║ ██║██╔██╗ ██║ ██╔══██║ ██║...