Thinfinity Iframe Injection

A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default could allow IFRAME injection via the "vpath" parameter. id: CVE-2021-45092 info: name: Thinfinity Iframe Injection author: danielmofer severity: critical description: A vulnerability exist...

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

BITB

BITB Browser templates for Browser In The Browser BITB attack. More information: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Usage Each folder has a index.html file which has 4 variables that must be modified: XX-TITLE-XX - The title that shows up for the page e.g. Sign in to your...

CVE-2023-4427

CVE-2023-4427 CVE-2023-4427 was found by glazunov, and you can find RCA in his report chrome version: 117.0.5938.62 in linux from v8ctf. I choose a very unstable method. To bypass ASLR, use many iframes with different domains in main.html to brute high address, you can change your /etc/hosts to...

quickjack

Quickjack Quickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. Use the Quickjack tool directly at http://samy.pl/quickjack/quickjack.html by @SamyKamkar // [email protected] // http://samy.pl // Dec 22, 2014 Code available...

CVE-2026-120987

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

CVE-2026-120987

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

CVE-2026-120987

Whale Browser versions prior to 5.39.412.57 are vulnerable to an iframe sandbox bypass occurring within a dual-tab environment . The root cause is associated with an Origin Validation Error (CWE-346). No specific exploit details or remediation instructions are provided in the documents.

EUVD-2026-115692

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads hxxps://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

MAL-2026-18455 Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads hxxps://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy

A flaw was found in WebKitGTK. Processing malicious web content can violate the iframe sandboxing policy due to improper validation...

CVE-2012-2593

Atmail XSS-CSRF-RCE Exploit Chain PoC atmail-rce.py: Exploits CVE-2012-2593 in Atmail's webmail interface. atmail-csrf.js: Javascript file which leverages CVE 2012-2593 into a CSRF to install a malicious plugin which executes a reverse shell Plugin.php: Atmail plugin to be installed which calls a...

MDaemon-Advisories

MDaemon-Advisories MDaemon Advisories: CVE-2021-27180 Reflected XSS CVE-2021-27181 CSRF Token Fixation CVE-2021-27182 Iframe injection CVE-2021-27183 Remote Code Execution Those vulnerabilities were already patched on January 2021 and are published for CVE purposes. They can be chained to achieve...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

enhanced-iframe-protection

Enhanced iFrame Protection - Browser Extension Enhanced iFrame Protection EIP is a lightweight extension to automatically detect and provide verbose warnings for embedded iframe elements in order to protect against Browser-In-The-Browser BITB attacks. Screenshots In the above screenshot, a phishi...

CLEANSTART-2024-VA87532 This issue was addressed with improved iframe sandbox enforcement

Security vulnerability affects the webkit2gtk package. This issue was addressed with improved iframe sandbox enforcement...

CLEANSTART-2024-ST75341 iframe sandbox element with the allow-popups flag could be bypassed when using noopener links

Security vulnerability affects the librewolf package. An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links...

CLEANSTART-2024-DQ40163 This issue was addressed with improved iframe sandbox enforcement

Security vulnerability affects the webkit2gtk package. This issue was addressed with improved iframe sandbox enforcement...