Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

WordPress-XStore-theme-SQL-Injection

WordPress-XStore-theme-SQL-Injection CVE-2024-33559 XStore theme-SQL Injection CVE-2024-33551 is a SQL injection vulnerability found in 8theme XStore, an ecommerce platform built on WordPress. This vulnerability allows attackers to execute malicious SQL commands on the database, which can lead to...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287 Credits I take no credit for the original discovery and exploitation of this vulnerability. Thank you to the following people! Discovery: Daniele Linguaglossa Metasploit Module...

CVE-2025-61454

🛡️ CVE Disclosure: CVE-2025-61454 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61454 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the search.php endpoint...

CVE-2023-51810

CVE-2023-51810 Description Blind SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 allows a remote attacker to obtain sensitive information via search parameter in the Users module. Product StackIdeas EasyDiscuss v5.0.5 - EasyDiscuss - Joomla Forum Discussion Tool - StackIdeas...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 is an Unauthenticated SQL Injection SQLi vulnerability affecting the WP Ticket Customer Support Ticket System & Helpdesk plugin for WordPress up to and including version 6.0.4.The flaw occurs because the plugin takes the WordPress search parameter s and concatenates it...

text4shell-cve-2022-42889

Text4Shell CVE-2022-42889 Docker Lab for CVE-2022-42889 You can either build the Docker image locally or pull the image from Docker Hub and run the container. Clone the repo git clone https://github.com/devenes/text4shell-cve-2022-42889.git Build the Docker image locally docker build...

cve-2022-42889-text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

CVE-2020-35545

CVE-2020-35545 Spotweb 1.4.9 - 'search' SQL Injection...

CVE-2026-76569

Reflected XSS via search GET Parameter in Phoca Download Phoca Download ≤ 6.1.4 — Authenticated Attacker Executes Arbitrary JavaScript via Crafted Search URL in User Control Panel SUMMARY Phoca Download comphocadownload for Joomla contains a reflected Cross-Site Scripting XSS vulnerability in the...

CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2016-10993

CVE-2016-10993 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://themesinfo.com/scoreme-wordpress-theme-design-496 Proof of Concept PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E Refrensi...

CVE-2024-50969

CVE-2024-50969 Description A Reflected cross-site scripting XSS vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts or HTML via the search parameter. Vulnerability Type Cross Site Scripting XSS Vendor of Product Code-projects...

CVE-2022-38553

CVE-2022-38553 CROSS SITE SCRIPTING XSS ON "ACADEMY LEARNING MANAGEMENT SYSTEM" POC VIDEO: Security Risk: This security vulnerability allows to execute arbitrary JavaScript code in user browser if they access URL prepared by attackers...

EUVD-2026-95540

Reflected Cross-Site Scripting XSS on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the...

CVE-2026-4264 Reflected Cross-Site Scripting in BeeTienda eCommerce platform

Reflected Cross-Site Scripting XSS on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the...

CVE-2026-4264

The BeeTienda eCommerce platform (specifically the latest demo version ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the lack of proper sanitization of user input in the 'search' parameter of the product list endpoint. Malicious payloads sent via this parameter are r...

CVE-2026-89417

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...