Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Drupal Avatar Uploader - Cross-Site Scripting Detection

Drupal Avatar Uploader v7.x-1.0-beta8 plugin contains a cross-site scripting vulnerability in the slider import search feature and tab parameter via plugin settings. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Avatar Uploader v7.""" from kittysploit import from lib.protocols.http.httpclie...

Let's Encrypt - Cross-Site Scripting Detection

Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL certificates. !/usr/bin/env python3 -- coding: utf-8 -- """Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL cert.""" from kittysploit...

Avaya Aura Utility Services Administration - Cross-Site Scripting Detection

Avaya Aura Utility Services Administration contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch oth...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via setPreferences. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe Experience Manager contains a cross-site scripting vulnerability via setPreferences.""" from kittysploit import from lib.protocols.http.httpclient import...

Open Akamai ARL - Cross-Site Scripting Detection

Open Akamai ARL contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Open Akamai ARL contains a cross-site scripting vulnerability.""" from...

Chamilo LMS 1.11.14 Cross-Site Scripting Detection

Chamilo LMS 1.11.14 is vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Chamilo LMS 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Chamilo LMS 1.11.14 Cross-Site Scripting...

FortiWeb - Cross Site Scripting Detection

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. !/usr/bin/env python3 -- coding:...

OURPHP <= 7.2.0 - Cross Site Scripting Detection

OURPHP = 7.2.0 is vulnerable to Cross Site Scripting XSS via /client/manage/ourphptz.php. !/usr/bin/env python3 -- coding: utf-8 -- """OURPHP = 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OURPHP = 7.2.0 - Cros...

WordPress Blogroll Fun-Show Last Post and Last Update Time 0.8.4 - Cross-Site Scripting Detection

WordPress Plugin Blogroll Fun-Show Last Post and Last Update Time 0.8.4 and possibly prior versions are prone to a cross-site scripting vulnerability because of a failure to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser ...

Sympa version =>6.2.16 - Cross-Site Scripting Detection

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. !/usr/bin/env python3 -- coding: utf-8 -- """Sympa version 6.""...

Magento Server Mass Importer - Cross-Site Scripting Detection

Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php. !/usr/bin/env python3 -- coding: utf-8 --...

MantisBT < 2.25.2 - Cross-Site Scripting Detection

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT...

KindEditor 4.1.11 - Cross-Site Scripting Detection

KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. !/usr/bin/env python3 -- coding: utf-8 -- """KindEditor 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

WordPress Slideshow - Cross-Site Scripting Detection

WordPress Slideshow plugin contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

cPanel < 11.109.9999.116 - Cross-Site Scripting Detection

An issue was discovered in cPanel before 11.109.9999.116. Cross Site Scripting can occur on the cpsrvd error page via an invalid webcall ID. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered in cPanel before 11.""" from kittysploit import from lib.protocols.http.httpclient impo...

Wavlink WN-535G3 - Cross-Site Scripting Detection

Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/login.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Wavlink WN-535G3 contains a POST cross-site scripting vulnerability via the hostname parameter at /cgi-bin/log.""" from kittysploit...

CVE-2026-58340

A flaw was found in Moodle. The grade item ID number editing functionality lacked proper security measures, making it vulnerable to Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS. A remote attacker could exploit these vulnerabilities to perform unauthorized actions or inject malicio...

CVE-2026-58339

A flaw was found in the Moodle Feedback activity module. Insufficient sanitization of the Feedback import error message could allow a remote attacker to perform a reflected Cross-Site Scripting XSS attack. This vulnerability enables the attacker to inject malicious scripts into a user's web...