openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health - all in one place. Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed| Lo...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads ... -- " !-- If number of iframes on the pa...

CVE-2026-119735

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119735 Munshi XSS via Purchase Inquiry Thread Rendering

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

EUVD-2026-115366

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119735

Munshi (by Petpooja) versions prior to 2026-07-13 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}) where malicious markup can be injected via item descriptions or messages. The root cause is ...

CVE-2026-119735: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated…

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 Stored XSS SQL Autocomplete innerHTML Sink Automated exploit for a stored cross-site scripting vulnerability in Appsmith's SQL query editor. A workspace Developer can inject arbitrary JavaScript via database table names that execute in any other workspace member's...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Conceptual Proof of Concept for the reflected Cross-Site Scripting XSS vulnerability in STIG Manager versions 1.5.10 through 1.6.7. Vulnerability Summary A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prom...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

phpmyadmin-vqb-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-vqb-xss Write-up: https://abraxaslabs.tech/research/phpmyadmin-vqb-xss phpmyadmin-vqb-xss Class: Stored XSS Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin js/src/designer/history.js builds...

CVE-2026-118057

The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI' parameter in all versions up to, and including, 22.3.2 due to insufficient input sanitization and output escaping. This mak...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

CVE-2026-40179-PoC

CVE-2026-40179 — Prometheus stored XSS via remotewrite A minimal, dependency-light proof of concept for CVE-2026-40179 GHSA-vffh-x6r8-xx99: stored cross-site scripting in the Prometheus web UI, delivered through an unauthenticated remotewrite endpoint. The vulnerability Prometheus 3.x renders...

Cross-site Scripting (XSS)

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Pagination language configuration sinks in Pagination.ts, where user-controlled text is assigned to innerHTML for page info, page numbers, ellipsis...

Cross-site Scripting (XSS)

Overview @highcharts/grid-lite is a Highcharts Grid Lite framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Pagination language configuration sinks in Pagination.ts, where user-controlled text is assigned to innerHTML for page info, page numbers,...

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

Impact When the HTML text parser cannot obtain a document from DOMParser because the call throws, it falls back to assigning the raw markup to the innerHTML of an element created in the hosting document, and the allow-list is applied only to the resulting DOM afterwards. In Chromium the Trusted...

GHSA-65HG-CF3F-5M39 Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

Impact When the HTML text parser cannot obtain a document from DOMParser because the call throws, it falls back to assigning the raw markup to the innerHTML of an element created in the hosting document, and the allow-list is applied only to the resulting DOM afterwards. In Chromium the Trusted...