BITB

BITB Browser templates for Browser In The Browser BITB attack. More information: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Usage Each folder has a index.html file which has 4 variables that must be modified: XX-TITLE-XX - The title that shows up for the page e.g. Sign in to your...

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

MDaemon-Advisories

MDaemon-Advisories MDaemon Advisories: CVE-2021-27180 Reflected XSS CVE-2021-27181 CSRF Token Fixation CVE-2021-27182 Iframe injection CVE-2021-27183 Remote Code Execution Those vulnerabilities were already patched on January 2021 and are published for CVE purposes. They can be chained to achieve...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...

CVE-2020-12696

CVE-2020-12696 ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Iframe iframe src="javascript:confirmdocument.cookie" width="100%" height="500" Version plugin: 4.4 Tested on: WordPress 5.2.4 Researche...

CVE-2023-4427

CVE-2023-4427 CVE-2023-4427 was found by glazunov, and you can find RCA in his report chrome version: 117.0.5938.62 in linux from v8ctf. I choose a very unstable method. To bypass ASLR, use many iframes with different domains in main.html to brute high address, you can change your /etc/hosts to...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – Security Misconfiguration ClickJacking ⚠️ Base Score: 6.5 MEDIUM Scale: CVSS ⚠️ 📌 Description This repository demonstrates a Clickjacking security flaw present on the G1 website. The vulnerability allows an attacker to load the site inside an iframe , overlaying malicious elements...

quickjack

Quickjack Quickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. Use the Quickjack tool directly at http://samy.pl/quickjack/quickjack.html by @SamyKamkar // [email protected] // http://samy.pl // Dec 22, 2014 Code available...

enhanced-iframe-protection

Enhanced iFrame Protection - Browser Extension Enhanced iFrame Protection EIP is a lightweight extension to automatically detect and provide verbose warnings for embedded iframe elements in order to protect against Browser-In-The-Browser BITB attacks. Screenshots In the above screenshot, a phishi...

CVE-2026-110510

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-110510 Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

EUVD-2026-108590

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-110510

The Essential Addons for Elementor WordPress plugin (versions before 6.8.7 ) contains a content injection vulnerability. The plugin fails to validate the HTML tag setting of certain widgets during markup generation. This allows users with author privileges or higher to inject iframe and form elem...

storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...

storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...

Thinfinity Iframe Injection

A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default could allow IFRAME injection via the "vpath" parameter. id: CVE-2021-45092 info: name: Thinfinity Iframe Injection author: danielmofer severity: critical description: A vulnerability exist...

storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...

PT-2026-121763

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

SUSE CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 Pandoc SSRF POC A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Install Pandoc https://pandoc.org/installing.html Payload Example ⚠️ replace iframe url to your own OAST...