32 matches found
Tiny-XSS-Payloads
Tiny-XSS-Payloads Una colecciΓ³n de cargas ΓΊtiles XSS cortas que se pueden usar en diferentes contextos. La DEMO disponible aquΓ: https://tinyxss.terjanq.me Cargas ΓΊtiles actuales root@kitploit: ... -- root@kitploit: root@kitploit: root@kitploit: root@kitploit:...
CVE-2026-82653
SiYuan before v3.8.1 is affected by a stored cross-site scripting (XSS) vulnerability in the confirmDialog() function. Unescaped package names and notebook names are interpolated directly into innerHTML assignments, allowing attackers to submit malicious bazaar packages with HTML/script payloads ...
CVE-2026-55566 Yamcs: DOM XSS in Extension Routing
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...
cve-2026-41200-stig-manager-oidc-reflected-xss
CVE-2026-41200 β PoC di XSS Riflesso OIDC in STIG Manager Proof of Concept concettuale per la vulnerabilitΓ di Cross-Site Scripting XSS riflesso in STIG Manager versioni 1.5.10 fino a 1.6.7. Riepilogo della VulnerabilitΓ Una vulnerabilitΓ di XSS riflesso esiste nel codice di gestione degli errori...
CVE-2023-4771
VulnerabilitΓ di cross-site scripting in CKEditor nell'esempio AJAX CVE-2023-4771 PoC CKEditor 4 VulnerabilitΓ di cross-site scripting XSS nell'esempio AJAX Questo documento descrive come eseguire una vulnerabilitΓ XSS CVE-2023-4771 utilizzando CKEditor. Assicurati di eseguire i seguenti passaggi...
CVE-2026-47666
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...
CVE-2026-47665
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...
CVE-2026-47666
Penpot (open-source design and prototyping platform) versions up to and including 2.14.3 are affected by a stored XSS via custom font family names. Arbitrary font-family strings are interpolated into a @font-face CSS rule and injected via innerHTML without sanitization, allowing an attacker to br...
CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...
openclaw-dashboard
OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health β all in one place. πΈ Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed|...
PT-2026-82331
Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...
CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field
Advisory di sicurezza: Cross-Site Scripting persistente non autenticato che porta al takeover dell'account amministratore openclaw-dashboard Titolo: OpenClaw Dashboard v3.0.0 Stored XSS tramite il campo Username del login fallito ID CVE assegnato: CVE-2026-66418 Repository target:...
CVE-2026-55085
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...
CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...
CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...
EUVD-2026-62710
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...
CVE-2026-68900 Wekan: Stored XSS in HTML board exports through a card-title second parse
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...
CVE-2026-33437
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...
CVE-2026-33437
In Stirling-PDF before 2.0.0, the Get Info workflow inserts untrusted PDF Title/Author metadata into the DOM via innerHTML in get-info-on-pdf.html, enabling stored XSS when a user clicks Get Info; the flaw is fixed in version 2.0.0. No exploitation evidence is provided in the documents.
CVE-2026-73052
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...