CVE-2025-51411

🛡️ CVE Disclosure: CVE-2025-51411 — Reflected XSS in Institute-of-Current-Students Disclosure Date: 25 July 2025 CVE ID: CVE-2025-51411 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the Institute-of-Current-Students v1.0 project, specifically...

CVE-2025-52097

CVE-2025-52097 – XSS réfléchie dans InstantForum.NET v4.1.4 Ce dépôt contient l'avis public, la preuve de concept et les documents associés pour CVE-2025-52097 , une vulnérabilité de cross-site scripting XSS réfléchie identifiée dans InstantForum.NET v4.1.4. Résumé Produit : InstantForum.NET v4.1...

CVE-2024-52794-Discourse-Stored-XSS

CVE-2024-52794 – Cross-Site Scripting XSS Almacenado en Discourse Resumen Descubrí una vulnerabilidad de cross-site scripting XSS almacenado en Discourse, una plataforma de foros de código abierto. La vulnerabilidad permite a un atacante ejecutar JavaScript arbitrario en el navegador de la víctim...

CVE-2024-4367

CVE-2024-4367 PoC Uso python poc.py mal.pdf "alert'0xr2r'" Referencias CVE-2024-4367: Ejecución arbitraria de JS en PDF.js PDF.js PoC Escáner plantillas...

CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Vulnerabilidades de Cross Site Scripting XSS Reflejado en Gibbon versión 22. https://vulners.com/cve/CVE-2021-40492 Existe una vulnerabilidad de Cross Site Scripting reflejado en varias páginas de la versión 22 de la aplicación educativa Gibbon que permite la ejecuci...

CVE-2025-50738-PoC

CVE-2025-50738 It is quite simple, a stored XSS via SVG is a very common way of finding Cross-Site Scripting in the wild, so it was one of the first things I did. I deployed the usememos via Pikapods, where I then navigated to the front-page and created an account. With the account, I created a...

CVE-2024-4367-POC

CVE-2024-4367 POC Usage python poc.py malicious.pdf "alert'S4vvy'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js...

CVE-2026-54433

CVE-2026-54433: Roundcube plain-text email stored XSS This repository contains a configurable Python proof of concept for CVE-2026-54433 , a stored cross-site scripting vulnerability in Roundcube's plain-text email renderer. An unauthenticated sender can deliver a crafted text/plain message. When...

Cross-site Scripting (XSS)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the add and update methods of the Certificates API, which parse SSL certificates and store the issuer organization value without sanitization. An attacker...

CVE-2026-100639

SiYuan v3.8.3 is vulnerable to a Cross-Site Scripting (XSS) flaw due to a failure to HTML-escape the data-subtype attribute during gutter-button markup generation. This occurs when content containing a Kramdown inline attribute list (IAL) is pasted as plain-text Markdown. The shared Lute renderer...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-100521

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

EUVD-2026-87377

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100522

Versions of Cotonti through 1.0.0 are vulnerable to a reflected cross-site scripting (XSS) flaw in the message.php file. The root cause is the improper escaping of the lng parameter before it is displayed in the confirmation dialog. This allows unauthenticated attackers to craft malicious links c...

CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100174

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174

The AIL Framework tag selector component (specifically var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of input sanitization for tag names; the application passes the displayField value directly to the jQuery .html() property in both the ...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...