CVE-2026-25940

CVE-2026-25940 jsPDF PoC A proof-of-concept for CVE-2026-25940 demonstrating how specially crafted AcroForm radio button appearances can trigger embedded JavaScript in vulnerable PDF viewers e.g., Foxit. The repo includes a Node-based generator and a browser viewer harness to exercise different...

CVE-2026-27574-OneUptime-RCE

CVE-2026-27574-OneUptime-RCE Overview Proof-of-Concept exploit for CVE-2026-27574 – a critical code injection vulnerability CWE-94 in OneUptime BOpen Registration B -- CRegister New Accou...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...

CVE-2025-56243

CVE-2025-56243 - Reflected XSS in PuneethReddyHC / Event Management System v1.0 Title: Reflected Cross-Site Scripting XSS via eventid parameter in register.php Vendor / Repository: PuneethReddyHC / event-management Affected Version: 1.0 branch/tag master at the time of testing Reporter: Hafiz...

CVE-2025-55854-PoC

CVE-2025-55854 - Stored Cross-Site Scripting XSS Vulnerability Vulnerability Overview CVE ID: CVE-2025-55854 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: High Affected Component: User Profile Bio Field Affected Application: FreelanceHub https://github.com/nooncarlett/FreelanceHub...

CVE-2026-30082

Stored Cross-site Scripting XSS vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server Affected version: IngEstate Server - 11.14.0 Affected Function Affected API: Affected API: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC To exploit this Stored...

CVE-2025-61319

CVE-2025-61319: Stored XSS in ReNgine 2. After scan completion, open the Vulnerabilities tab in ReNgine and view results. 3. The payload executes in the admin's browser context. Affected versions ReNgine = 2.2.0 Remediation Sanitize and escape user-supplied input before rendering scan results...

CVE-2026-30048

CVE-2026-30048 - Stored Cross-Site Scripting XSS in NotChatbot WebChat Video Demonstration https://youtu.be/HklaoNKP9H8 Steps to Reproduce 1. Integrate the WebChat widget using the official package/CDN 2. Open the chat int...

CVE-2024-4367-hands-on

!IMPORTANT This repository is for learning about vulnerabilities. This hands-on must be performed on a computer you properly manage. Do not engage in any illegal activities. The author assumes no responsibility for any damages or liabilities arising from this repository. CVE-2024-4367-hands-on...

CVE-2022-32118

CVE-2022-32118 - Arox-XSS Existen vulnerabilidades de Cross Site Scripting XSS almacenado y reflejado en múltiples páginas de la aplicación Arox School ERP Pro, incluida la página de inicio de sesión, que permiten la ejecución arbitraria de comandos JavaScript. La aplicación tiene muchos más...

CVE-2025-65270

CVE-2025-65270 ⚠️ Aviso legal Este repositorio es solo para fines educativos y de investigación defensiva 🔥 Descripción general Vulnerabilidad de cross-site scripting XSS reflejado en ClinCapture EDC 3.0 y 2.2.3 , que permite a un atacante remoto no autenticado ejecutar código JavaScript en el...

CVE-2021-40514

CVE-2021-40514 Vulnerabilidad de Cross Site Scripting Almacenado en OSCAR McMaster 19.401235 Existe una vulnerabilidad de Cross Site Scripting almacenado en múltiples páginas de la versión 19.401235 de la aplicación OSCAR McMaster que permite la ejecución arbitraria de comandos JavaScript. Marcad...

CVE-2025-69606-GSVoIP-XSS

CVE-2025-69606 — XSS Reflejado en el Panel Web de GSVoIP Severidad: Media | CWE: CWE-79 | Auth Requerida: No | Vector: Remoto Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Reflejado en el Panel Web de GSVoIP v2.0.90. El parámetro msg del endpoint de error no sanitiza la...

Published-CVE

Published-CVE Este repositorio contiene descripciones y exploits para dos vulnerabilidades de seguridad: 1. CVE-2023-33580: Cross-Site Scripting Almacenado XSS en el Student Study Center Management System V1.0, que permite a atacantes ejecutar código JavaScript arbitrario. 2. CVE-2023-33584:...

CVE-2019-0678

Vulnerabilidad Vulnerabilidad de elevación de privilegios en Microsoft Edge Descripción de la vulnerabilidad Esta vulnerabilidad permite a un atacante ejecutar código JavaScript en cualquier host sin permiso, también puede robar archivos locales del sistema y esto además resulta en el cambio de...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 SVG XSS Reflejado Cross-Site Scripting XSS Reflejado mediante Renderizado SVG en FuguHub https://vulners.com/cve/CVE-2025-65790 Este repositorio documenta una vulnerabilidad de Cross-Site Scripting XSS Reflejado en FuguHub 8.1 , donde los archivos SVG que contienen...

EUVD-2026-90577

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-19902 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2024_1484)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241484 advisory. nss: timing attack against RSA decryption CVE-2023-5388 Mozilla: Crash in NSS TLS method CVE-2024-0743 Mozilla: JIT code failed to save return registers on...