CVE-2026-17532

Seraphinite Accelerator . One URL, no authentication: http://TARGET/?seraphaccelprep=alertdocument.domain" Usage Python needs pip install requests: usage: seraphaccelxss.py -h --url URL --payload PAYLOAD --timeout TIMEOUT Seraphinite Accelerator WordPress alertdocument.domain --timeout TIMEOUT...

CVE-2014-9219

CVE-2014-9219 CVE-2014-9219 XSS POC About The vulnerability is caused by an input validation error in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 when processing url parameter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitra...

CVE-2025-63589

CVE-2025-63589 Reflected XSS in CMSimpleXH index.php path handling Discovered: October 6, 2025 Products: CMSimpleXH open-source flat-file CMS Affected versions: 1.8 CVEs: CVE-2025-63589 Authentication required: None unauthenticated Attack type: Reflected Cross-Site Scripting XSS Estimated CVSS...

CVE-2025-65270

CVE-2025-65270 ⚠️ Disclaimer This repository is for educational and defensive security research only 🔥 Overview Reflected cross-site scripting XSS vulnerability in ClinCapture EDC 3.0 and 2.2.3 , allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's...

CVE-2025-63588

CVE-2025-63588 Reflected Cross-Site Scripting XSS in CMSimpleXH cmsimplexh path handling Estimated CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medium Assigned CVE: CVE-2025-63588 Products: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Summary A reflected Cross-Site...

CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 Reflected XSS via DICOM Image Upload Handler If you want to chain this XSS with RCE you can read: https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce Description OpenClinic GA = v5.351.19 12/05/2026 contains a reflected cross-site...

CVE-2023-54413

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wplang parameter. Attackers can lure users to /wp-login.php with a wplang value injecting an ima...

CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2017-20288

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...

EUVD-2023-60723

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wplang parameter. Attackers can lure users to /wp-login.php with a wplang value injecting an ima...

CVE-2023-54413

The WPML Multilingual CMS plugin for WordPress versions prior to 4.6.1 is vulnerable to a reflected cross-site scripting (XSS) flaw. The vulnerability exists due to insufficient input validation of the wp_lang parameter. An unauthenticated attacker can craft a malicious link to /wp-login.php cont...

EUVD-2020-31287

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

CVE-2020-37284

The Sickbeard software, versions through build-507 , is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the testNaming handler failing to escape the pattern parameter of the /config/postProcessing/testNaming endpoint. Unauthenticated attackers can craft GET r...

EUVD-2017-19027

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

CVE-2017-20290

The Discourse platform, versions 1.9.0.beta2 before 1.9.0.beta13 , is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is that the unsubscribed.html.erb template renders the email parameter from the /email/unsubscribed endpoint unescaped via the html_safe method. Unauthen...

EUVD-2017-19025

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...

CVE-2017-20288

QCubed versions 2.2.0 through 3.1.1 are vulnerable to a reflected cross-site scripting (XSS) flaw. An unauthenticated attacker can inject malicious scripts by crafting GET requests to the /assets/php/_devtools/installer/step_2.php endpoint, specifically by providing malicious values in the instal...

CVE-2025-12101-checker

CVE-2025-12101-checker Simple Python PoC to check Citrix NetScaler ADC / Gateway instances for CVE-2025-12101 reflected XSS on /cgi/logout using a crafted SAMLResponse + RelayState payload. ⚠️ Use this tool only on systems you own or are explicitly authorized to test. 🔍 Background CVE-2025-12101...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Conceptual Proof of Concept for the reflected Cross-Site Scripting XSS vulnerability in STIG Manager versions 1.5.10 through 1.6.7. Vulnerability Summary A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error...

CVE-2026-39200

CVE-2026-39200 — Reflected Cross-Site Scripting XSS in Toko Online RotI Summary A reflected Cross-Site Scripting XSS vulnerability was identified in the produk request parameter of the Toko Online RotI web application. The application fails to HTML-encode user-supplied input before reflecting it...