WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425

WonderCMS 4.3.2 XSS to RCE Exploits Overview These scripts exploit an XSS Cross-Site Scripting vulnerability in WonderCMS 4.3.2 to achieve Remote Code Execution RCE. The XSS payload, when triggered by the admin, automatically installs a reverse shell on the target server by leveraging a crafted...

CVE-2012-2593

Atmail XSS-CSRF-RCE Exploit Chain PoC atmail-rce.py: Exploits CVE-2012-2593 in Atmail's webmail interface. atmail-csrf.js: Javascript file which leverages CVE 2012-2593 into a CSRF to install a malicious plugin which executes a reverse shell Plugin.php: Atmail plugin to be installed which calls a...

xss

Este repositorio no tiene un README...

CVE-2023-31584

CVE-2023-31584 - Vulnerabilidad de Cross Site Scripting en cu/silicon Enlace de GitHub: https://github.com/cu/silicon Versión afectada: 1 Gravedad y CVSS: Se actualizará cuando NIST complete la revisión. Tipo: Cross Site Scripting Causa raíz: Falta de validación y saneamiento adecuados de las...

CVE-2021-43141

CVE-2021-43141 Información sobre CVE-2021-43141, un XSS reflejado en la sección planapplication...

EUVD-2026-92020

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin,...

CVE-2025-28074

CVE-2025-28074 Suggested description phpList prior to 3.6.3 is vulnerable to Cross-Site Scripting XSS due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing ...

CVE-2019-15233

CVE-2019-15233 FAB-2019-00157 Vulnerability discoverd by me CVE-2019-15233 Advisory: advisory Basic Info Advisory ID: FAB-2019-00157 Product: Live Input Macros Manufacturer: Old Street Solutions Affected Versions: 2.10 and before Tested Versions: 2.10 Vulnerability Type: Cross-Site Scripting CWE-...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check es un script simple de Python para verificar la vulnerabilidad SSRF Server-Side Request Forgery / Content Spoofing en el endpoint /image del framework Astro. Esta vulnerabilidad se rastrea como GHSA-qpr4-c339-7vq8 y CVE-2025-58179. Antecedentes de la...

CVE-2021-42558

CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

Credits to @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main for details read: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Tested On Chromium 119.0.6045.123 built on Debian trixie/sid, running on Debian kali-rolling...

CVE-2026-104313 WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ruledata' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-46451

CVE-2023-46451 Descripción sugerida Sourcecodester Best courier management system v1.0 es vulnerable a Cross Site Scripting XSS en el campo de cambio de nombre de usuario. Información adicional Aquí actualizo el video POC en YouTube: https://youtu.be/f8B3m5YfqI Tipo de Vulnerabilidad Cross Site...

CVE-2026-103888 WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2022-29455

CVE-2022-29455 Vulnerabilidad de WordPress - XSS Cross-Site Scripting Ubicación de la Vulnerabilidad https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Versión vulnerable = 3.5.5 Prueba de Concepto Exploit https://add your target...

Roundcube-CVE-2024-42008-POC

CVE-2024-42008 RoundCube XSS Exploit Overview This repository contains a proof-of-concept exploit for CVE-2024-42008 , a Cross-Site Scripting XSS vulnerability in RoundCube webmail application. This exploit is designed for educational purposes and controlled penetration testing environments like...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2019-12538

CVE-2019-12538 Vulnerabilidad XSS en Zoho ManageEngine ServiceDesk Plus 9.3 en SiteLookup.do Descripción de la información: Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro qcsiteID de SiteLookup.do. Autor: Concobe de Tarantula Team - VinCSS miemb...

CVE-2024-24135

CVE-2024-24135: Inventario de Productos con Exportación a Excel - Cross-Site-Scripting Prueba de Concepto PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24135.md Prueba de Concepto PoC : https://github.com/BurakSevben/CVE-2024-24135/blob/main/CVE-2024-24135.md...