CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Gibbon version 22 Reflected Cross Site Scripting XSS Vulnerabilities. https://vulners.com/cve/CVE-2021-40492 A reflected Cross Site Scripting vulnerability exists in multiple pages in version 22 of the Gibbon education application that allows for arbitrary execution ...

CVE-2024-42009

CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...

CVE-2021-40513

CVE-2021-40513 OSCAR McMaster 19.401235 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 19.401235 of the OSCAR McMaster application that allows for arbitrary execution of JavaScript commands. Placeholder for CVE mitre...

cve-2025-0133

CVE-2025-0133 Reflected XSS Detection Tool Author : Derek Odiorne Date : 2025-05-23 Severity : Medium Tested Against : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 Summary This script performs safe, authorized testing for the vulnerability CVE-2025-0133 , a reflected Cross-Site Scripting XSS...

CVE-2024-4367-POC

CVE-2024-4367 POC Usage python poc.py malicious.pdf "alert'S4vvy'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js...

CVE-2021-3395

CVE-2021-3395 Suggested description A cross-site scripting XSS vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment. Vulnerability Type Cross Site Scripting XSS Vendor of Product OOO...

detect-cve-2024-4367

Detect CVE-2024-4367 Quick-and-dirty YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDF.js. Usage $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf Credits POC and disclosure from...

CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

com.heytap.browser

Vulnerability Report Overview: A vulnerability has been discovered in the com.heytap.browser application on the Android platform. The vulnerability allows an attacker to execute arbitrary JavsScript code within the context of the application without any permissions. Application Details: Vendor: -...

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. If pdf.js is...

CVE-2026-39107

CVE-2026-39107: Cross-Site Scripting XSS in Kimi AI v1.0 Description A Cross-Site Scripting XSS vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches...

CVE-2026-36226

CVE-2026-36226: Advantech WebAccess/SCADA Create New Project User XSS PoC This repository contains a benign proof of concept for CVE-2026-36226, a cross-site scripting issue in Advantech WebAccess/SCADA 8.0-2015.08.16. This repository is for authorized security research and local reproduction onl...

cve-2024-4367-PoC-fixed

cve-2024-4367-PoC-fixed PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This vulnerability allows an attacker to execute arbitrary JavaScript code immediately after opening a malicious PDF file. This affects all Firefox users 126, as Firefox uses PDF.js to display PDF files, but al...

CVE-2025-50738-PoC

CVE-2025-50738 It is quite simple, a stored XSS via SVG is a very common way of finding Cross-Site Scripting in the wild, so it was one of the first things I did. I deployed the usememos via Pikapods, where I then navigated to the front-page and created an account. With the account, I created a...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...

WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting

The Tag Groups WordPress plugin 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with editpages capability, exploit requires victim interaction...

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting XSS via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2024-9007 info: name: 123Solar 1.8.4.5 - Cross-Site Scripting author: ritikchaddha...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2710 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting author:...

Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting

Appium = 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests. id: CVE-2026-58191 info: name:...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2712 info: name: Yonyou UFIDA ERP-NC V5.0 -...