CVE-2023-49974

CVE-2023-49974 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "contact" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor...

CVE-2026-105089

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2024-4367

CVE-2024-4367 PoC Uso python poc.py mal.pdf "alert'0xr2r'" Referencias CVE-2024-4367: Ejecución arbitraria de JS en PDF.js PDF.js PoC Escáner plantillas...

CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias

ZenarioCMS Reflected XSS v.9.4.59197 Author: Sergio Description: Cross Site Scripting vulnerability in ZenarioCMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. Attack Vectors: Scripting a vulnerability in the sanitization of th...

CVE-2026-105089

WWBN AVideo versions through 29.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises because the application fails to escape the video trailer1 URL when rendered in YouPHPFlix2 templates and channel playlists. An attacker with upload permissions can inject a malicious ...

CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

EUVD-2026-92110

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - Cross-Site Scripting reflejado XSS Descripción: Existe una vulnerabilidad de XSS reflejado en el endpoint /admin?page=media en el parámetro file, que permite a un atacante inyectar código JavaScript arbitrario. Pasos para explotar: 1- Iniciar sesión en el CMS y...

CVE-2025-52385

CVE-2025-52385 Software : Studio 3T v.2025.1.0 Vulnerability Report : Studio 3T Remote Command Execution Overview A critical vulnerability in Studio 3T version 2025.1.0 and earlier allows a remote attacker to execute arbitrary code via a crafted payload exploiting the childprocess module in the...

CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Vulnerabilidades de Cross Site Scripting XSS Reflejado en Gibbon versión 22. https://vulners.com/cve/CVE-2021-40492 Existe una vulnerabilidad de Cross Site Scripting reflejado en varias páginas de la versión 22 de la aplicación educativa Gibbon que permite la ejecuci...

CVE-2023-46998

Cross Site Scripting in Bootbox.js v.3.2 thru 6.0 allows a remote attacker to to inject HTML code and execute arbitrary JavaScript. Summary Vendor: BootBox Product: bootbox.js Affected versions: 3.2 to 6.0 CodeName: Venga-Que-Si-Es-Pa-Eso Vulnerability Type: Improper Neutralization of Input Durin...

CVE-2025-50738-PoC

CVE-2025-50738 It is quite simple, a stored XSS via SVG is a very common way of finding Cross-Site Scripting in the wild, so it was one of the first things I did. I deployed the usememos via Pikapods, where I then navigated to the front-page and created an account. With the account, I created a...

CVE-2024-4367-POC

CVE-2024-4367 POC Usage python poc.py malicious.pdf "alert'S4vvy'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js...

HW-Pyton-10

CVE-2020-11022 Brief description CVE-2020-11022 is a Reflected XSS Cross-Site Scripting vulnerability related to incorrect processing of user input that is reflected in the HTML response without escaping. An attacker can inject JavaScript code that will execute in the user's browser...

Follina-CVE-2022-30190-Sample

Follina-CVE-2022-30190-Sample-by-ethical-blue Educational Follina Tool Version history v1.1 — JavaScript payload obfuscation v1.0 — Initial release Features .RTF payload generator Simple HTTP Server for payload Mitigation tips Configuration extractor Easy to use for learning Exploit Executed...

CVE-2026-54433

CVE-2026-54433: Roundcube plain-text email stored XSS This repository contains a configurable Python proof of concept for CVE-2026-54433 , a stored cross-site scripting vulnerability in Roundcube's plain-text email renderer. An unauthenticated sender can deliver a crafted text/plain message. When...

CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...

CVE-2022-25063

CVE-2022-25063 Este script explota una vulnerabilidad XSS en el router TPLink WR840N, utilizando un campo para inyectar código JavaScript...

CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation

Subrion CMS Reflected XSS v4.2.1 Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and...