CVE-2025-55888

CVE-2025-55888 Description Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered,...

pritunl-CVE-2020-25200

CVE-2020-25200 Pritunl VPN server - Affected version: Pritunl v1.29.2145.25 553bbd ========================= Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username i...

CVE-2025-29602

CVE-2025-29602 - Vulnerabilidades de cross site scripting XSS almacenado en FlatPress CMS 1.3.1 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en el panel de administración de Flatpress CMS 1.3.1. Un atacante con privilegios de administrador puede inyectar una carga...

CVE-2020-9484

La herramienta se utiliza únicamente para investigación de seguridad y auditorías internas. Está prohibido usar la herramienta para lanzar ataques ilegales; el usuario es responsable de las consecuencias. La herramienta se utiliza únicamente para investigación de seguridad y auditorías internas...

CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit

Wing FTP Server v8.1.2 contains a Remote Code Execution RCE vulnerability in the session serialization mechanism. An authenticated administrator can inject arbitrary Lua code through the domain admin mydirectory basefolder field, which gets executed server-side via loadfile. This is a separate...

CVE-2025-24813

CVE-2025-24813 - Apache Tomcat Remote Code Execution Exploit This is a proof-of-concept PoC exploit for CVE-2025-24813 , a vulnerability in Apache Tomcat 9.0.80–9.0.83, 10.1.0–10.1.17 that allows remote code execution RCE via session deserialization. The exploit abuses partial PUT requests and th...

Termix-research

Investigación de seguridad de Termix Investigación de vulnerabilidades en Termix, una plataforma web de gestión de SSH y servidores más de 13k estrellas. CVE| Problema| Severidad| Corregido| Aviso ---|---|---|---|--- CVE-2026-45746| Secuestro de sesión → RCE| 9.0 Crítica| v2.3.2|...

PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...

CVE-2026-20079-checker

CVE-2026-20079 Cisco FMC Read-Only Checker Una pequeña utilidad de validación deliberadamente limitada para CVE-2026-20079 , la vulnerabilidad de omisión de autenticación de Cisco Secure Firewall Management Center FMC. Este repositorio es un verificador, no un exploit. No contiene las partes de...

CVE-2025-14855-POC

CVE-2025-14855: Prueba de Concepto de XSS Almacenado en el Plugin SureForms de WordPress Objetivo: Plugin de WordPress "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Tipo de vulnerabilidad: Cross-Site Scripting Almacenado XSS CVE: CVE-2025-14855 Referencia:...

SysAid 20.4.74 - Cross-Site Scripting

SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via the KeepAlive.jsp stamp parameter. id: CVE-2021-31862 info: name: SysAid 20.4.74 - Cross-Site Scripting author: jas37 severity: medium description: SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. id: CVE-2012-4242 info: name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author:...

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

School Dormitory Management System 1.0 contains an authenticated cross-site scripting vulnerability via admin/inc/navigation.php:125. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-bas...

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

WordPress Country Selector <1.6.6 - Cross-Site Scripting

WordPress Country Selector plugin prior to 1.6.6 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the country and lang parameters before outputting them back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in th...

ZZcms - Cross-Site Scripting

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. id: CVE-2020-20285 info: name: ZZcms -...

CandidATS 3.0.0 - Cross-Site Scripting

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add New Field function at /index.php?module=entities/fields&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...