openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health — all in one place. 📸 Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed|...

CVE-2023-31779

CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

CVE-2024-55040-Sensaphone-XSS

SENSAPHONE VULNERABILITY DISCLOSURE Summary In mid-September 2024, I identified several medium-to-low severity security issues in the Sensaphone Web600 Monitoring System, including stored cross-site scripting XSS vulnerabilities in the system Setup, Profile, and Zone options. Remote authenticated...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

EUVD-2026-78076

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-90943

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-90943

parallax/filament-comments (through 3.0.0 ) contains a stored cross-site scripting vulnerability in comment body rendering. The root cause is unescaped output in the comment display views (comments.blade.php) and policy layer, allowing authenticated panel users to inject malicious scripts into co...

EUVD-2026-77580

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CitrixBleedCVE-2026-8452-2025-5777

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing. https://satoshi-box.com/pay/CSHeT8...

CVE-2023-31851

CVE-2023-31851 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/status has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. CVE-2026-79294 Stored XSS in Moonshot AI Kimi's HTML artifact...

CVE-2026-81731

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-81731

Frappe versions 15.11.0 through 16.32.0 contain a stored XSS in the Workspace Link doctype's description field. The field is declared with ignore_xss_filter: 1 , causing _sanitize_content() to skip HTML filtering. The unfiltered value is later interpolated into a Bootstrap popover via LinksWidget...

EUVD-2026-67236

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...