CVE-2020-0674-PoC

CVE-2020-0674 关于该漏洞的复现操作: 关键在于Html的编写 Python源码提供自动化测试Html网页的功能 利用selenium库 提供的IEdriver测试下来支持IE11 脚本使用需要输入Html路径以及驱动路径...

CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87812

SiYuan before v3.8.2 is affected by a stored cross-site scripting vulnerability in Bazaar package cards. The root cause is that the iconURL metadata is inserted directly into HTML img src attributes without escaping , allowing attackers to inject malicious URLs with embedded event handlers. When ...

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

EUVD-2026-74838

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87811

SiYuan before v3.8.2 is affected by a Stored XSS vulnerability in its notebook configuration feature. The root cause is improper attribute encoding when persisted notebook template paths are inserted into HTML input value attributes. An attacker can craft a malicious template path that breaks out...

EUVD-2026-74837

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-33331

CVE-2026-33331 — XSS almacenado en el plugin de referencia OpenAPI de oRPC Laboratorio de prueba de concepto para XSS almacenado en la generación de documentación OpenAPI de orpc Propósito oRPC construye páginas de documentación de API a partir de una especificación OpenAPI. Antes de la v1.13.9,...

EP3_Redes

EP3Redes 用GO语言实现的HTML服务器，用于分析漏洞CVE-2023-29406。...

cve-testing

.. include:: ../disclaimer-zhCN.rst :Original: Documentation/admin-guide/README.rst :译者: 吴想成 Wu XiangCheng [email protected] Linux内核6.x版本 http://kernel.org/ 以下是Linux版本6的发行注记。仔细阅读它们， 它们会告诉你这些都是什么，解释如何安装内核，以及遇到问题时该如何做。 什么是Linux？ Linux是Unix操作系统的克隆版本，由Linus Torvalds在一个松散的网络黑客...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-4447

CVE-2026-4447 - V8 in Google Chrome prior to Remote Code Execution Quick Usage root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-20 Technical...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

swagger-ui

Introducción: El Rol de Swagger UI Swagger UI es una librería ampliamente utilizada que renderiza especificaciones OpenAPI anteriormente Swagger en una interfaz web interactiva. Permite a desarrolladores e integradores explorar y probar APIs sin necesidad de tener la implementación del backend...

CVE-2026-85630

A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...

CVE-2026-85418

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...