CVE-2026-104906

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104847

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...

EUVD-2026-91743

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907

MISP is vulnerable to a cross-site scripting (XSS) flaw in the remote event preview page. The issue arises because tag identifiers are rendered within an inline JavaScript onclick attribute; while these values are HTML-escaped, they are not properly sanitized for a JavaScript string context. A ma...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906

The MISP platform contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer (versions

EUVD-2026-91742

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

study-turbolinks-link

Uso de JavaScript https://github.com/turbolinks/turbolinksapi-reference Turbolinks.visit'/home/two' // default is advance. Turbolinks.visit'/home/two', action: 'advance' Turbolinks.visit'/home/two', action: 'replace'...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload es un toolkit de Smuggling HTML para generar páginas HTML que incrustan y reconstruyen archivos usando JavaScript. Proporciona múltiples métodos de Smuggling HTML , opciones de codificación de payloads, variaciones de JavaScript y varias plantillas HTML integrada...

CVE-2026-86536 Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript

Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue...

CVE-2025-58434-59528-htb-ctf

CVE-2025-58434-59528-htb-ctf Cadena de Explotación Silentium Este repositorio contiene la cadena de explotación completa para la máquina Silentium de Hack The Box. El exploit aprovecha una vulnerabilidad en dos fases que implica enumeración de usuarios e inyección de JavaScript para lograr...

CVE-2018-25031

POC de Cross-Site Scripting en Swagger UI: CVE-2018-25031 utilizando Selenium en Python Este repositorio contiene un script en Python que demuestra una prueba de concepto POC de una vulnerabilidad de Cross-Site Scripting XSS en Swagger UI, usando la biblioteca Selenium. El objetivo de esta POC es...

CVE-2022-35499

En Trimble TM4WEB =22.2.0 el endpoint del visor externo de facturas es vulnerable a cross-site scripting reflejado mediante la inyección en un parámetro arbitrario añadido a la URL. Paso 1 : El siguiente ejemplo de URL activará la vulnerabilidad y ejecutará la función javascript alert mostrando e...

jsluicepp

📄 Tabla de contenidos 👋 Introducción 🛠️ Configuración 📝 Uso 📜 Características Monitorizar URLs Enviar a Repeater Secretos Notificaciones de secretos Copiar URL Coincidencia positiva/negativa Solo en el alcance Etiquetas en línea Ocultar duplicados Mostrar parametrizados Importar/Exportar Guardar...

MAL-012

MAL-012: Cross-Site Scripting Reflejado en la Consola de Administración que conduce a Ejecución Remota de Código en Payara Server Se encontró un ataque de Cross-Site Scripting XSS reflejado en la Consola de Administración de Payara. Al convencer a un usuario administrador de que acceda a la URL...

MAL-011

MAL-011: La mala configuración de Log4J permite JavaScript malicioso en Red Hat AMQ El componente Log4J de la aplicación Redhat A-MQ está mal configurado, lo que permite la ejecución de atributos “Script” arbitrarios en la configuración de Log4J. Si un atacante encuentra una forma de modificar la...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – Inyección de JavaScript en PDF mediante script incrustado Código del programa Python que genera un PDF malicioso generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf...