CVE-2026-124410

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpLingua Translation Service Translate and boost SEO Automatic AI translation wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO Automatic AI translation wpLingua: from...

CVE-2026-124410

The wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua WordPress plugin (versions up to and including 3.1.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) . The vulnerability is caused by the Improper Neutralization of Input During Web Page Generati...

EUVD-2026-125424

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2...

EUVD-2026-125422

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.14...

EUVD-2026-125289

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4...

CVE-2026-126954

Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title,...

CVE-2026-128025

The FrankenPHP web server version before 1.13.0 is vulnerable to a path-split interpretation conflict in the splitPos function within cgi.go . This flaw allows unauthenticated attackers to bypass route-level or WAF deny rules by embedding .php extensions inside filename components (e.g., requesti...

EUVD-2026-125056

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught...

OpenNebula-CVE-2025-56534

OpenNebula-CVE-2025-56534 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in the custom authenticator driver Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix :...

CVE-2023-38831-winrar-exploit

CVE-2023-38831 winrar exploit generator Quick poc test Generate the default poc for test python cve-2023-38831-exp-gen.py poc or python cve-2023-38831-exp-gen.py CLASSIFIEDDOCUMENTS.pdf script.bat poc.rar Custom 1. Place the bait file and evil script file in the current directory, the bait file i...

Malicious code in garvisometerui (PyPI)

Source: kam193 09877eb0403bbdcc0057b40370627c99965eaf5b4d8215cc4b23ea8c089bc9b8 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in qwen3ttsui (PyPI)

Source: kam193 2c64f86bb29e534513cdf30a837f2ff458b45eac42c8e35f191b952481ef7c3f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in voxcpmttslora (PyPI)

Source: kam193 b40228df9bac54fb38c660c1a82e16e409a25f416bdd35e4d50339abf8891f2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

CVE-2023-38831

CVE-2023-38831 Exploit - Bait and Switch Archive Generator Overview This Python script is designed to generate a "bait and switch" archive file. It is meant for educational and ethical hacking purposes only. Please ensure that you have the necessary permissions before using this script. A "bait a...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2026-23744-script

A script for CVE-2026-23744, which exploits MCPJam Inspector versions = 1.4.2. Based off the curl command used here: https://github.com/advisories/GHSA-232v-j27c-5pp6 Make sure your /etc/hosts file is correct and points to the domain/vhost of the target...

XcInspector

XcInspector: for Xcode Project Security XcInspector is a macOS app, and command line tool, to scan Xcode project files for possible security issues. Source Code Repository on GitLab List of planned checks rules Why? There are some ways that Xcode projects can be used to compromise security and...

WordPress Welcart e-Commerce < 2.12.7 - Cross-Site Scripting

Welcart e-Commerce Plugin up to 2.12.6 contains a stored XSS caused by improper escaping of the ResponseCd argument in ESCOTTMAIN::errorpagemessage, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2026-120597 info: name: WordPress Welcart e-Commerce 2.12.7 -...

NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting

NextGEN Gallery through 4.2.3 reflects a URL-decoded nggtag route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an svg onload payload...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...