JS-Tap

JS-Tap v3.0.4 This tool is intended to be used on systems you are authorized to attack and for legal and educational purposes. Do not use this tool for illegal purposes, or I will be very angry in your general direction. Changelogs Major changes are documented in the project Announcements:...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. Description The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion...

mqxss

mqxss v0.2 mqxss выступает в качестве клиента для взаимодействия с перехваченными браузерами через MQTT Преимущество использования этого инструмента по сравнению с beef или xsshunter в том, что помимо размещения JS-пейлоада не требуется настраивать инфраструктуру — можно использовать публичный...

toxssin

toxssin Objectif toxssin est un outil de test d'intrusion open-source qui automatise le processus d'exploitation des vulnérabilités de type Cross-Site Scripting XSS. Il se compose d'un serveur https qui agit comme un interpréteur pour le trafic généré par la charge utile JavaScript malveillante q...

CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Reaper Description : This repository provides a Proof-of-Concept PoC and simple exploit for CVE-2025-54589 , a reflected Cross-Site Scripting XSS vulnerability in Copyparty ≤ 1.18.6. By injecting crafted JavaScript payloads into the filter...

poc_CVE-2025-68613

PoC: n8n Sandbox Escape CVE-2025-68613 Educational Purposes Only This Proof of Concept demonstrates a critical vulnerability CVE-2025-68613 in n8n. Do not use this on systems you do not own or have explicit permission to test. Vulnerability Overview n8n versions prior to 1.122.0 contain a Remote...

CVE-2017-1000486

CVE-2017-1000486 Proof of Concept Exploit for PrimeFaces 5.x EL Injection CVE-2017-1000486, a RCE vulnerability that can be used to gain Remote Code Execution on a target. Vulnerability description You can find an excellent description of the vulnerability on the Minded Security blog. Usage The...

Project-CVE-2026-65351

BROWSER BOMB / PAYLOAD ИСТОЩЕНИЯ РЕСУРСОВ Анализ и документация по стресс-тестирующему браузерному скрипту, разработанному Xer0TLabs & Persephrak Decentralized Syndicate. ВНИМАНИЕ: Только для образовательных, исследовательских и авторизованных целей тестирования. Запуск этого скрипта немедленно...

CVE-2025-52385

CVE-2025-52385 Программное обеспечение : Studio 3T v.2025.1.0 Отчёт об уязвимости : Удалённое выполнение команд в Studio 3T Обзор Критическая уязвимость в Studio 3T версии 2025.1.0 и более ранних позволяет удалённому злоумышленнику выполнять произвольный код с помощью специально созданной нагрузк...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

Palo Alto Networks PAN-OS 10.0.x / 10.2.x / 11.0.x / 8.1.x / 9.0.x / 9.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 8.1.x, 9.0.x, 9.1.x, 10.0.x, 10.2.x, or 11.0.x. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious...

CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16-h2 / 11.2.x < 11.2.13-h2 / 12.1.x < 12.1.10 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16-h2, 11.2.x prior to 11.2.13-h2, or 12.1.x prior to 12.1.10. It is, therefore, affected by a vulnerability. A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a...

CVE-2026-85593: Improper Neutralization of Input During Web Page Generation

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-15386

The Meow Gallery WordPress plugin versions before 5.5.2 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape an attachment's alt text before it is output into an attribute of a link built for linked galleries. This allows users with the Author role or highe...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...