vuln-chain-lab

File Upload Bypass + Stored XSS PoC Lab A deliberately vulnerable web application demonstrating how a file upload bypass chains with stored XSS to create backdoor admin accounts, even when CSP, CORS, and CSRF protections are in place. Full Blog Post: KurtiseBear Blog This is an educational lab fo...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — Same-Origin Policy bypass via cross-port interception CVE-2026-20643...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77912

A stored cross-site scripting (XSS) vulnerability exists in GitHub Enterprise Server within the Markdown rendering pipeline . The flaw occurs because the pipeline rewrote quote characters in already-sanitized HTML without performing subsequent re-sanitization, allowing an authenticated attacker t...

EUVD-2026-84873

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

dref

DNS Rebinding Exploitation Framework This project is no longer maintained. dref does the heavy-lifting for DNS rebinding. The following snippet from one of its built-in payloads shows the framework being used to scan a local subnet from a hooked browser; after identifying live web services it...

whonow

Whonow DNS 服务器 一个恶意的 DNS 服务器，用于动态执行 DNS 重新绑定攻击。whonow 让你能够 通过域名请求本身 动态指定 DNS 响应和重新绑定规则。 root@kitploit: 首次查询该域名时响应 34.192.228.43，之后每次都响应 192.168.1.1 A.34.192.228.43.1time.192.168.1.1.forever.rebind.network 首次响应 34.192.228.43，接下来五次响应 192.168.1.1，然后重新开始（1次，5次，循环往复...）...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...

CVE-2026-59814

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-46650

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-46650

Joplin (open-source note-taking app) prior to 3.7.2 contains a stored XSS in the public share viewer. The root cause is an unanchored regular expression in isAcceptedUrl() (packages/renderer/htmlUtils.ts) that allows a javascript: URL containing a matching 32-character path fragment to pass valid...

CVE-2026-59814

Joplin Server prior to version 3.7.7 is vulnerable to stored XSS via the GET /shares/:id?resource_id= route. When a resource has an empty title, the server serves it with an attacker-controlled MIME type and omits Content-Disposition, allowing a low-privileged user to publish an image/svg+xml att...

CVE-2026-73546

Envoy 's /stats?format=html admin endpoint is vulnerable to stored XSS because StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can embed attacker-controlled path segments into ...

CVE-2026-43735

CVE-2026-43735 WebKit cross-origin information leak. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principle When the parent page uses to trigger a fragment navigation of a cross-origin iframe, the NavigateEvent.sourceElement received by the iframe is the element of the parent page...

nosurf-cve-2025-46721

CVE-2025-46721: CSRF due to non-functional same-origin checks in justinas/nosurf What happened? Am I affected? PoC Patching Acknowledgements What happened? All versions of nosurf before 1.2.0 failed to apply same-origin checks for incoming requests. This happened due to relying on the .URL.Scheme...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable . Befor...