CVE-2020-8825

CVE-2020-8825 Publish: CVE-2020-8825 Vendor: PHP VanillaForum Description: The vulnerability exists due to insufficient sanitization of user-supplied data passed to "index.php?p=/dashboard/settings/branding" URL. A remote attacker can permanently inject and execute arbitrary HTML and script code ...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Webmin-1.580---file-show.cgi-Manual-Remote-Command-Execution-Non-Metasploit-

Markdown Webmin 1.580 RCE Execution Guide Quick reference for executing authenticated Remote Code Execution RCE on Webmin 1.580 via the /file/show.cgi component. 1. Attack Machine Listener Run this command on your local machine to catch the incoming connection before executing the payload: rlwrap...

CVE-2026-22849

CVE-2026-22849: Saleor lacks proper HTML sanitization in rich text fields Overview Field| Details ---|--- CVE ID| CVE-2026-22849 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products saleor/saleor Details Saleor was allowing users to modify rich text fields with HTM...

CVE-2024-33231

Ferozo Webmail XSS Vulnerability via File Upload CVE-2024-33231 Description Ferozo Webmail version 1.1 is vulnerable to Cross-Site Scripting XSS through the file upload functionality. An attacker can exploit this vulnerability by uploading a specially crafted file containing malicious JavaScript...

CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XSS vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient inpu...

CVE-2024-9264

🚨 CVE-2024-9264 - Grafana SQL injection leading to Remote Code Execution RCE and file Read Exploit tool for CVE-2024-9264, a critical vulnerability in Grafana allow authenticated attcker to execute sql query leading to RCE 🛡️ This tool is strictly for educational purposes and authorized penetratio...

CVE-2024-39304

Description This script is a PoC for CVE-2024-39304, where a SQLi is possible due to a lack of sanitization in the ChurchCRM project. Usage python3 CVE-2024-39304.py -u -p -b -v Example: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v Links...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 Overview This is my research on CVE-2025-2945. This repo includes a test stand with postgress and vulnerable pgadmin, and exploit. CVE Usefull links: NVD Details WIZ Analyze Metasploit Breakdown In pgAdmin backend, which is written in python, there are two endpoint...

CVE-2025-63821

CVE-2025-63821 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Severity CVSS v4.0 Base Score: 4.8 Medium Vector:...

CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: ConcreteCMS v9.2.1 is affected by Arbitrary File Upload vulnerability which allows Cross-Site Scriting XSS stored. Attack Vectors: A vulnerability in "Thumbnail" file upload sanitation allows you to upload a PDF / SVG /HTML file with hidd...

CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata in the Settings- Global Settings Menu. Attack Vectors: Scripting A vulnerability...

CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user

CMSmadesimple Reflected XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in install/adduser.php of CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again in the My Preferences - Add...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...

CVE-2026-18548 Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

DRUPAL-CORE-2026-016

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administ...

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that ...

PT-2026-114414

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administ...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administ...

CVE-2026-103424 Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...