119029 matches found
CVE-2026-109724
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
tryhackme-moniker-link
tryhackme-moniker-link Documentation of my hands-on lab Moniker Link CVE-2024-21413 completed on TryHackMe. Moniker Link CVE-2024-21413 — TryHackMe Lab Overview This repository documents my hands-on study in a TryHackMe room. The goal of this exercise was to understand how the vulnerability works...
CVE-2026-109780
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Core & HTML component...
CVE-2026-109725
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
CVE-2026-62990
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant...
CVE-2026-119343
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...
Instatic-Stored-XSS-CVE-2026-103931
URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...
CVE-2026-119343 Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...
EUVD-2026-114459
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...
CVE-2026-119343
Stirling-PDF versions prior to 3.0.0 are vulnerable to Server-Side Request Forgery (SSRF) and local file read due to missing HTML sanitization. The POST /api/v1/ai/tools/create-pdf-from-html-agent endpoint accepts attacker-controlled htmlContent and passes it directly to WeasyPrint without using ...
CVE-2026-119343 Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...
CVE-2026-119343 Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...
CLEANSTART-2024-QN07444 Lack of escaping allowed HTML injection when a webpage was viewed in Reader View
Security vulnerability affects the firefox package. Lack of escaping allowed HTML injection when a webpage was viewed in Reader View...
CLEANSTART-2024-KS53084 When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead
Security vulnerability affects the firefox-esr package. When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead...
CLEANSTART-2024-RH40188 Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers
Security vulnerability affects the firefox package. Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers...
cve_2013_3893_trigger.html
This repository does not have a README...
CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day
XSS 0-Click / 0-Day Vulnerability Report Cross-Site Scripting 0-Click Leading to JavaScript Bridge Abuse in Pocket Android & iOS — CVSS 9.2 CRITICAL CVE-2026-82090 — Published by MITRE Corporation 2026-08-28 Author: Ing. Zampier Zago FUNFACTOR1 Division: Section 1 — Department of Cyber Security, ...
CLEANSTART-2024-KZ62911 out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations
Security vulnerability affects the firefox-esr package. An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations...
CLEANSTART-2024-GI83091 SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API
Security vulnerability affects the firefox package. SVG use tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API...