CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...

shlol

SHLOL This is a menu you can trigger with a keybind to do basic stuff for you Really easy to use Create listeners on the fly No copy pasting needed Choose the type, IP and PORT and you are done! Run remote scripts easily Reverse Shell Generator...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

CVE-2026-51990

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Malicious code in taskquay (PyPI)

Source: kam193 692f4bcca72a6b53c989001619446e8b3b5bd66716674ca8230baa6d9d4c60a5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in workslip (PyPI)

Source: kam193 6a509c00601b9f218feeb0cf12a7f84899efaf786edee659338d53d9888aa507 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in runpier (PyPI)

Source: kam193 ab469bbd671fcc96fad392de06c7652a4f9ea899df3c86d285397bfc3985a690 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in thornqueue (PyPI)

Source: kam193 ea756029aedec54cd447267056236a9c4a6752d1a9973198ebf71c300fcd9112 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in thistlerun (PyPI)

Source: kam193 6c35afe278e655040c47dcca9e63b4ab75c1530880041568e544700daa20e887 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in kestreljob (PyPI)

Source: kam193 4a86144582538adae41c5d2f14f22daae1f65ecf9b93cdeb0d82889681af9222 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in otterload (PyPI)

Source: kam193 6860fc5e0584389884eadd8bf39289d71d5c8c6dc01ca64603f3af344be8d755 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in reedworker (PyPI)

Source: kam193 f309ea93245f05b07163de9b85a0e47dcd64eeaec705794c502b21429eced883 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in sedgehaul (PyPI)

Source: kam193 1eccea61ba89da6dd32ddad1e54e70f52c5a2b2c9aeeced8a80e068ef63dccd4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in loadferry (PyPI)

Source: kam193 6d5ed5a4ca84e5e36cc5a87ee1ef6652bb96f1dbe1ef3340a041060c6bb9f477 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in marshrunner (PyPI)

Source: kam193 689d5b87d977bc368c98efb8cf42d53c25465575a667cd61337bb403dfdcb4fb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in larchworker (PyPI)

Source: kam193 87e174c9dc2485263894e4d6c3d1560589659afbfbe9397ca1e1b53fb21d96b3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...