Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

ipyida

= IPyIDA IPyIDA is a python-only solution to add an IPython console to IDA Pro. Use to open a window with an embedded Qt console. You can then benefit from IPython's autocompletion, online help, monospaced font input field, graphs, and so on. You can also connect to the kernel outside of IDA usin...

shlol

SHLOL Este es un menú que puedes activar con una combinación de teclas para hacer cosas básicas por ti Muy fácil de usar Crear listeners sobre la marcha No es necesario copiar y pegar Elige el tipo, IP y PUERTO y ¡listo! Ejecuta scripts remotos fácilmente Generador de Reverse Shell...

CVE-2023-08-21-exploit

Título del exploit: Axigen if xhr1.readyState === XMLHttpRequest.DONE hcookie...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the keyboard interface in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...

MAL-2026-17472 Malicious code in anthropic-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511 The package publishes as anthropic-sdk and re-exports the official anthropic client's symbols from anthropic import ; re-exports of...

Malicious code in anthropic-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511 The package publishes as anthropic-sdk and re-exports the official anthropic client's symbols from anthropic import ; re-exports of...

CVE-2026-51990

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

CVE-2025-8191

CVE-2025-8191 – Inyección XSS en Swagger UI Descripción : Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE‑2025‑8191, una vulnerabilidad encontrada en Swagger UI. La vulnerabilidad permite la inyección de Cross‑Site Scripting XSS en el campo “description”, lo que conduce a ...

CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa syntax: title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-48482

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-48482: Improper Limitation of a Pathname to a Restricted Directory

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in the Browser Switcher component of Google Chrome prior to version 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...