PAN-OS - Reflected Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The...

Mongoose - NoSQL Injection Detection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

MajorDoMo - Cross-Site Scripting Detection

MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a reflected XSS caused by...

MAMP Server - Cross-Site Scripting Detection

A Cross-Site Scripting XSS vulnerability exists in the default installation of MAMP server. The file /Applications/MAMP/htdocs/index.php is susceptible to malicious input, allowing attackers to inject JavaScript code that executes in the context of the victim's browser. This vulnerability can be...

Oracle Siebel Loyalty 8.1 - Cross-Site Scripting Detection

A vulnerability in Oracle Siebel Loyalty allows remote unauthenticated attackers to inject arbitrary Javascript code into the responses returned by the '/loyaltyenu/start.swe/' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Oracle Siebel Loyalty allows remote...

SMTP Credentials Exposure - Detection

Detects exposed SMTP credentials username and password in a webpage's HTML or JavaScript source code. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed SMTP credentials username and password in a webpage's HTML or JavaScript source code.""" from kittysploit import from...

Fronsetiav1.1 - Cross-Site Scripting Detection

The fronsetiav1.1 application is vulnerable to a Reflected XSS attack through the showoperations.jsp endpoint. An attacker can inject malicious scripts via the WSDL Location input, which is executed in the victim's browser due to improper input sanitization. This allows attackers to execute...

Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting Detection

Rumpus FTP Web File Manager 8.2.9.1 contains a reflected cross-site scripting vulnerability via the Login page. An attacker can send a crafted link to end users and can execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Rumpus FTP Web File Manager 8.""" from kittysploit...

Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

Revive Adserver <=5.0.3 - Cross-Site Scripting Detection

Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php...

BIT-THRIFT-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Joern 4.0.590

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-66920: Uncontrolled Recursion

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-66922: Improperly Controlled Modification of Object Prototype Attributes

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

ROS-20260728-73-0017

The vulnerability of the Browser Tree and Explain Visualizer modules in the pgAdmin 4 database management tool exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in the DOM: Navigation...

Linux Distros Unpatched Vulnerability : CVE-2026-55968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects...

RHEL 8 : firefox (RHSA-2026:47105)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:47105 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libaom:...

ALSA-2026:47105 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in the DOM: Navigation...