EUVD-2026-91170

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...

a2sv

1. A2SV? Auto Scanning to SSL Vulnerability. HeartBleed, CCS Injection, SSLv3 POODLE, FREAK... etc A. Support Vulnerability - CVE-2007-1858 Anonymous Cipher - CVE-2012-4929 CRIMESPDY - CVE-2014-0160 CCS Injection - CVE-2014-0224 HeartBleed - CVE-2014-3566 SSLv3 POODLE - CVE-2015-0204 FREAK Attack...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Informe de vulnerabilidad del sitio oficial de Nueva Jersey Bootstrap 4.0.0 Encontrado en https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Información de vulnerabilidad: Medium 28236 XSS en las propiedades data-template, data-content y data-title de...

CVE-2026-93367

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

hackazon

Hackazon Hackazon 是一个免费的、存在漏洞的测试网站，它是一个在线商店，使用了当今富客户端和移动应用所采用的技术构建。Hackazon 拥有 AJAX 界面、严格的工作流以及由配套移动应用使用的 RESTful API，为 IT 安全专业人员提供了独特的有效训练和测试平台。而且，它充满了你喜爱的各种漏洞，如 SQL 注入、跨站脚本等。 当今的 Web 和移动应用以及 Web 服务包含大量新技术，这些技术并未得到充分的安全性测试。IT 安全专业人员迫切需要一种存在漏洞的 Web 应用，用于测试其工具的有效性并磨练自身技能。 Hackazon...

hackazon

Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...

CVE-2026-93367

The Visitors Traffic Real Time Statistics Pro plugin for WordPress (versions up to and including 11.22 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization on the page_title parameter within the ahcpro_track_visitor AJAX action, which i...

CVE-2026-93367 Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

ransomwatch

RansomWatch RansomWatch 是一款勒索软件泄露站点监控工具。它会爬取多个勒索软件泄露站点上的所有条目，将数据存储在 SQLite 数据库中，并在出现新受害者或受害者被删除时通过 Slack 或 Discord 发送通知。 注意：RansomWatch 并未针对最新站点进行积极更新，主要依赖第三方贡献。请提交 Pull Request，和/或通过Twitter 私信联系我。 配置 在 configvol/ 目录下，请将 config.sample.yaml 复制为 config.yaml，并添加以下内容： 泄露站点...

CVE-2024-37383_PoC

Repositorio para practicar directamente la vulnerabilidad CVE-2024-37383. Informe de análisis: blog / pdf CVE-2024-37383 Detalle Nombre : Roundcube Webmail SVG Parsing XSS Objetivo : Roundcube Webmail v1.5.7 o v1.6.x manipulada en un correo electrónico, se ejecuta un script arbitrario en el...

CSPTPlayground

Campo de juegos de Path Traversal del lado del cliente !Doyensec Research...

Centos Web Panel 0.9.8.480 - Local File Inclusion

Centos Web Panel version 0.9.8.480 suffers from local file inclusion vulnerabilities. Other vulnerabilities including cross-site scripting and remote code execution are also known to impact this version. id: CVE-2018-18323 info: name: Centos Web Panel 0.9.8.480 - Local File Inclusion author:...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

twitter-server Cross-Site Scripting

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. id: CVE-2020-35774 info: name: twitter-server Cross-Site...

WordPress UserPro 4.9.32 - Cross-Site Scripting

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. id: CVE-2019-14470 info: name: WordPress UserPro 4.9.32 - Cross-Site Scripting author: daffainfo severity: mediu...

CHIYU TCP/IP Converter - Cross-Site Scripting

CHIYU BF-430, BF-431 and BF-450M TCP/IP Converter devices contain a cross-site scripting vulnerability due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi. id: CVE-2021-31250 info: name: CHIYU TCP/IP Converter - Cross-Site Scripting author: geeknik...

xss-payload-list

xss-payload-list 🎯 Lista de payloads de vulnerabilidad de Cross Site Scripting XSS...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 Autor: Sergio Descripción: WBCE CMS 1.6.1 está afectado por una vulnerabilidad de Cross-Site Scripting almacenado XSS que permite a los atacantes ejecutar código arbitrario a través de un payload creado en el parámetro Intro Page del menú Pages. El payload se ejecutará ...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirige a un sitio web arbitrario en este caso, https://example.com. patched: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

SUSE CVE-2019-7621

Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting XSS flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboa...