CVE-2012-2593

سلسلة استغلال XSS-CSRF-RCE في Atmail - PoC atmail-rce.py: يستغل CVE-2012-2593 في واجهة البريد الإلكتروني لـ Atmail. atmail-csrf.js: ملف جافاسكريبت يستخدم CVE 2012-2593 لتحويلها إلى CSRF لتثبيت إضافة ضارة تنفذ شيل عكسي Plugin.php: إضافة Atmail سيتم تثبيتها تستدعي شيل عكسي !!استخدم فقط ضد خوادم لدي...

dns-rebind-toolkit

مجموعة أدوات إعادة ربط DNS عرض توضيحي | إشعار أمني | الحمولات المضمنة | الأسئلة الشائعة إخلاء مسؤولية: هذا البرنامج لأغراض تعليمية فقط. لا ينبغي استخدام هذا البرنامج في أنشطة غير قانونية. المؤلف غير مسؤول عن استخدامه. لا تكن وغدًا. مجموعة أدوات إعادة ربط DNS هي إطار عمل JavaScript أمامي لتطوير...

MDaemon-Advisories

إعلانات MDaemon إعلانات MDaemon: CVE-2021-27180 XSS منعكس CVE-2021-27181 تثبيت رمز CSRF CVE-2021-27182 حقن Iframe CVE-2021-27183 تنفيذ كود عن بعد تم تصحيح هذه الثغرات بالفعل في يناير 2021 وتم نشرها لأغراض CVE. يمكن ربطها لتحقيق تنفيذ كود عن بعد/الاستيلاء على الحساب عبر رسالة بريد إلكتروني يتطلب...

CVE-2025-51591-Pandoc-SSRF-POC

إثبات المفهوم POC لثغرة SSRF في Pandoc CVE-2025-51591 تتيح ثغرة تزوير الطلبات من جانب الخادم SSRF في JGM Pandoc الإصدار 3.6.4 للمهاجمين الوصول إلى البنية التحتية بالكامل واختراقها عبر حقن iframe مُعدّ بعناية. تثبيت Pandoc https://pandoc.org/installing.html مثال على الـ Payload ⚠️ استبدل رابط ifram...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-6954

Cross-Site Scripting XSS vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dynamic iframe into the victim’s browser by sending a malicious URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can be...

CVE-2026-8845 Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within th...

EUVD-2026-32081

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within th...

PT-2026-43510

The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' and 'button' shortcode attributes in the rspc check shortcod...

CVE-2026-39390

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting cMap field in compInfosPost sanitizes input using striptags with an allowlist and regex-based removal of...

CVE-2026-3516

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clmapiframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFiel...

RealtyScript 跨站脚本漏洞

RealtyScript is a real estate website management system developed by RealtyScript Corporation. Version 4.0.2 of RealtyScript contains a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of text parameters, which may allow attackers to inject malicious HTML and...

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

CVE-2026-3327

This CVE concerns the DatoCMS Web Previews plugin, where an authenticated user can perform an iframe injection by bypassing the frontend URL restriction. The root cause is an insecure handling of embedded resources in the Web Previews feature, affecting versions earlier than 1.0.31. Impact is the...

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

PT-2026-22341

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...