EUVD-2026-68240

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2021-24884

CVE-2021-24884 XSS2RCE in Formidable 4.09.04 Formidable 4.09.04 allowed to inject certain HTML Tags like ,,, and . This could allow an unauthenticated, remote attacker to exploit a HTML-injection by injecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - Vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Descripción técnica: Existe una vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Un atacante puede aprovechar esta...

CVE-2023-47119

Tabla de contenidos CVE-2023-47119 Análisis detallado POC Escalada ? Configuración del LAB CVE-2023-47119 Un POC para CVE-2023-47119 que es una vulnerabilidad que afecta a Discourse versiones anteriores a la versión 3.1.3 de la rama stable y a la versión 3.2.0.beta3 de las ramas beta y...

CVE-2024-26521

CVE-2024-26521 CE-Phoenix-v1.0.8.20 Vulnerabilità di HTML Injection Pagina di Login Come possiamo vedere, c'è una pagina di login. È facile capire che in questa applicazione è presente una vulnerabilità di HTML Injection. Fondamentalmente, in questa applicazione tutti i file PHP sono salvati in...

CVE-2023-28467

MyBB 1.8.33 – XSS persistente nel campo email del User CP root@kitploit: - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Soluzione Aggiorna MyBB alla versione 1.8.34 o successiva...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 prova rapida root@kitploit: import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text oppure root@kitploit: POST /wp-login.php...

EUVD-2026-67873

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

leaflet-cve-2025-69993

CVE-2025-69993 — XSS no Leaflet bindPopup Vulnerabilidade de Cross-Site Scripting no Leaflet = 1.9.4. O método bindPopup renderiza a entrada fornecida pelo usuário como HTML bruto sem sanitização, permitindo a execução arbitrária de JavaScript. Estrutura do Repositório ADVISORY.md — Aviso de...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 prima della versione 11.3.757 è vulnerabile a un'iniezione HTML persistente nel pannello di amministrazione di CrushFTP Reports / "Who Created Folder", consentendo l'esecuzione persistente di HTML nelle sessioni di amministrazione. CWE CWE-79 — Neutralizzazione impropria...

CVE-2025-63419

CVE-2025-63419 CrushFTP vor 11.3.760 ist anfällig für HTML Injection. Der webbasierte Server verfügt über eine Funktion, mit der Benutzer Dateien teilen können. Die Funktion reflektiert den Dateinamen unverändert in ein emailbody-Feld ohne Sanitisierung, was zu HTML Injection führt. CWE CWE-79 —...

CVE-2024-23998

Another Redis Desktop Manager PoC Una Proof-of-Concept per la vulnerabilità CVE-2024-23998. 1. Panoramica della vulnerabilità: Oggetto della vulnerabilità: Esecuzione locale di codice tramite XSS Versione vulnerabile: = 1.6.6 Tipo di attacco: Esecuzione remota di codice Vettori di attacco: Per...

CVE-2022-30781

🍵 CVE-2022-30781 Exploit di esecuzione remota di comandi tramite migrazione repository Gitea. Come usare 1. Esegui un server filesystem HTTP con i file in questo repository. 2. Modifica il comando da eseguire in api/v1/repos/e99/exp/pulls/1/index.html L96. 3. Migra un repository remoto con URL...

EUVD-2026-67403

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

CVE-2021-46079

CVE-2021-46079 Titolo dell'Exploit: Vehicle Service Management System - 'Multiplo' Caricamento file porta a Iniezione HTML Autore dell'Exploit: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 ALTO Riferimenti:...

EUVD-2026-67170

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Klick-Schwachstelle zur Ausführung beliebigen Codes. CVE-2022-21241 ⚠ Dieser PoC wurde erstellt, um Benutzer zu warnen und Schwachstellen in ihrer eigenen CSV+ zu untersuchen. Die Nutzung für Angriffe ist untersagt. Schwachstelle Die folgenden Versionen sind betroffen...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

CVE-2026-81820

Flowintel versions greater than 3.3.0 are vulnerable to HTML injection in the MISP case history timeline. Attacker-controllable MISP object fields (object UUID, name, attribute value, attribute type, comment, first/last seen, and IDS flag) were concatenated directly into HTML strings before rende...