CVE-2026-30251

ZenShare Suite - 漏洞披露 本仓库包含在 ZenShare Suite 应用程序中发现的多个反射型跨站脚本（XSS）漏洞的详细信息。 漏洞概述 ZenShare Suite 应用程序存在影响登录和密码恢复功能的反射型跨站脚本（XSS）漏洞。攻击者可以通过构造恶意 URL 并诱骗受害者访问该 URL 来利用这些问题，从而在受害者的浏览器中执行任意 JavaScript 代码。 CVE-2026-30251 描述 Interzen Consulting S.r.l 的 ZenShare Suite v17.0 中 loginnewpwd.php...

CVE-2026-106445: Incomplete List of Disallowed Inputs

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

cve-2023-41564-research

CVE-2023-41564脆弱性概要 CVE-2023-415641はCockpitというCMSmodule'assets'-extend // 省略 'upload' = functionstring|array $param = 'files', array $meta = , bool $isUpload = true $files...

CVE-2026-105694

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105694 Penpot: Stored XSS via Unsanitised SVG Uploads

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

EUVD-2026-92713

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2021-39408

CVE-2021-39408 Online Student Rate System 应用程序的多个 1.0 版本中存在一个反射型跨站脚本（XSS）漏洞，允许任意执行 JavaScript 命令。 受影响页面 在 index.php 中，page 参数存在漏洞，攻击者可以在 script 标签内包含任意 javascript： http://localhost/index.php?page=alert'test'; 由 Stefan Dorresteijn 于 2021 年 8 月发现...

CVE-2024-4367-hands-on-01

!IMPORTANT 本仓库用于学习漏洞。 本次动手实践请务必在自己管理下的合适计算机上进行。绝对不要进行违法行为。 此外，因本仓库产生的任何损害・责任，作者概不承担。 CVE-2024-4367-hands-on 体验 CVE-2024-4367 的动手实践 创建 poc.pdf python CVE-2024-4367-PoC/CVE-2024-4367.py "alert'document.domain'" 引用来源：https://github.com/LOURC0D3/CVE-2024-4367-PoC 将创建攻击用的 poc.pdf。 详细用法请参考以下内容。...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - 「customerlist」ページの"email"フィールド/パラメータにおけるクロスサイトスクリプティング（XSS）脆弱性 説明 : Customer Support System 1.0は格納型XSSに対して脆弱です。Customer Support...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2025-1015

CVE-2025-1015：Thunderbird 通讯录包含未净化的 URI 字段，可能被攻击者利用。通过创建带有恶意链接的通讯录，攻击者可诱骗其他用户导入被入侵的通讯录。如果用户在 Thunderbird 中点击未净化的链接，可能导致在 Thunderbird 客户端内打开的网页上任意执行非特权 JavaScript。这会带来严重的安全风险，因为攻击者可能借此操纵用户会话或窃取敏感信息。...

CVE-2026-102295 Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-102295

A cross-site scripting (XSS) vulnerability exists in Quay within the OAuth callback handler (specifically via the oauth local callback format=json parameter). The root cause is improper input sanitization , which allows a remote attacker to execute arbitrary JavaScript in a user's browser by tric...

EUVD-2026-92518

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-102295

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2024-37888

CVE-2024-37888 このリポジトリは、自身が発見し報告したCVE-2024-37888の脆弱性の詳細とエクスプロイトを文書化しています。 Metrics CWE-79: ウェブページ生成時の入力の中和の不備（クロスサイトスクリプティング） CVSS: 6.1 中 脆弱性の概要 この Proof of Concept POC は、私が最近発見したOpen LinkプラグインのXSS脆弱性の悪用を示しています。このプラグインが有効になると、CKEditor...

Astra Linux – Vulnerability in Firefox

An attacker was able to insert an event handler into a privileged object, allowing arbitrary JavaScript execution in the parent process. Note: This vulnerability only affects Desktop Firefox; mobile versions of Firefox are not affected. This vulnerability applies to Firefox versions earlier than...

CVE-2021-3395

CVE-2021-3395 Descripción sugerida Una vulnerabilidad de cross-site scripting XSS en Pryaniki 6.44.3 permite a usuarios autenticados remotos cargar un archivo arbitrario. El código JavaScript se ejecutará cuando alguien visite el archivo adjunto. Tipo de Vulnerabilidad Cross Site Scripting XSS...

kibana-prototype-pollusion

CVE-2019-7609 在 5.6.15 之前的 Kibana 版本以及 6.6.1 版本中，Timelion 可视化工具存在任意代码执行缺陷。拥有 Timelion 应用访问权限的攻击者可以发送一个请求，尝试执行 JavaScript 代码。这可能导致攻击者以主机系统上 Kibana 进程的权限执行任意命令。 CVSS: 博客: https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/ Payload: https://github.com/mpgn/CVE-2019-7609 目标 设...

CVE-2026-36226

CVE-2026-36226: Prueba de Concepto XSS de Crear Nuevo Usuario de Proyecto en Advantech WebAccess/SCADA Este repositorio contiene una prueba de concepto benigna para CVE-2026-36226, un problema de cross-site scripting en Advantech WebAccess/SCADA 8.0-2015.08.16. Este repositorio es solo para...