EUVD-2026-96888

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

CVE-2024-25411

CVE-2024-25411 A cross-site scripting XSS vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php Vulnerability Type : Cross Site Scripting XSS Vendor of Product :...

CVE-2025-44136

CVE-2025-44136 Unauthenticated XSS in MapTiler Tileserver-php v2.0. Description MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to...

CVE-2026-108566

A cross-site scripting (XSS) vulnerability exists in InstantSoft icms2 versions up to 2.18.2 . The flaw is located in the index function of the templates/default/controllers/messages/index.tpl.php file within the Private Message Handler component. Improper handling of the nickname argument allows...

Bludit-3.13.1-About-Plugin-Stored-Cross-Site-Scripting-XSS

CVE-2021-45745 Exploit Title: Bludit 3.13.1 - About Plugin Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-45745 CVSS: 5.4 MEDIUM References: https://www.plsanu.com/bludit-3-13-1-about-plugin-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-45745...

ritm

Ruby In The Middle Proxy de intercepción HTTP/HTTPS Ruby in the middle RITM es un proxy de intercepción HTTP/HTTPS con generación y firma de certificados sobre la marcha, que deja al usuario con todo el poder del lenguaje Ruby para interceptar e incluso modificar peticiones y respuestas a su...

nes-vuetify-cve-2025-1461

Vuetify VCalendar XSS Vulnerability POC CVE-2025-1461 This repository contains a proof of concept demonstrating the XSS vulnerability in Vuetify's VCalendar component, specifically in the eventMoreText prop. Vulnerability Details CVE ID : CVE-2025-1461 Affected Versions : =2.0.0 3.0.0 Severity :...

CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...

CVE-2017-9934

CVE-2017-9934 I am the reporter of this exploit, under name: Envo Joomla 1.7.3 - 3.7.2 CSRF exploit PoC This vulnerability works due to Joomla versions 1.7.3 to 3.7.2 not sanitizing base64 input. Headers: POST...

CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...

CVE-2023-43263

CVE ID : CVE-2023-43263 Vulnerability Type : Cross-Site Scripting Description : Cross-site scripting XSS vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component. Steps to reproduce : Enter payload in markdown component input: Reference : 1...

CVE-2026-30691

CVE-2026-30691 - Vulnerability Advisory Official MITRE vulnerability record details and technical documentation for CVE-2026-30691. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Suggested description Cross-Site Scripting XSS vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote...

CVE-2022-25063

CVE-2022-25063 This script exploits a vulnerability XSS in the TPLink WR840N router, using a field for injecting javascript code...

CVE-2024-34224

Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...

tulpar

Tulpar es un escáner de vulnerabilidades web de código abierto diseñado para automatizar las pruebas de penetración web. Tulpar tiene las siguientes características. Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory...

VBA-RunPE

VBA RunPE Description A simple yet effective implementation of the RunPE technique in VBA. This code can be used to run executables from the memory of Word or Excel. It is compatible with both 32 bits and 64 bits versions of Microsoft Office 2010 and above. More info here:...

CVE-2022-3464

CVE-2022-3464 A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument sitename leads to cross site scripting. It is possible to initiate the attack remotely. The associated...

CVE-2023-50596

CVE-2023-50596 Suggested description Cross Site Scripting vulnerability in Simple Image Stack Website using PHP and API v.1.00000 allows a remote attacker to execute arbitrary code via a crafted payload to the URL. Additional Information Lets paste our payload in the URL section...

CVE-2024-51032

CVE-2024-51032 Description A Cross-site Scripting XSS vulnerability in managerecipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2024-48415

CVE-2024-48415 Description itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting XSS via a crafted payload to the lastname, firstname, middlename, address, contactno, email and taxid parameters in new borrowers functionality on the Borrowers page. Vulnerability Type: Cros...