Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 This proof of concept PoC demonstrates the exploitation of two vulnerabilities in Roundcube Webmail that enable CSS injection and a cross-site scripting XSS. The attack consists of two stages: 1. XSS via malicious XML attachment CVE-2024-42008...

SuiteCRM-RCE

CVE-2020-28328 SuiteCRM Remote Code Execution via Log File System Setting and Log File Poisioning Overview I recently discovered two vulnerabilities in SuiteCRM that provides an attack chain for a low privileged user to achieve code execution on the underlying operating system. The attack chain i...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

CVE-2019-10779

CVE-2019-10779 GCHQ Stroom is vulnerable to Cross-Site Scripting due to the ability to load the Stroom dashboard on another site and insufficient protection against window event origins...

railsgoat

RailsGoat RailsGoat is a deliberately vulnerable web application built on Ruby on Rails. It demonstrates real-world security vulnerabilities from the OWASP Top 10 and serves as a hands-on training platform for developers and security professionals. What is RailsGoat? RailsGoat is an intentionally...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload POC of DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite I'm a simple man, I see cvss:10/10 I go in xD I saw this new CVE CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content...

CVE-2020-17453-PoC

CVE-2020-17453 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. PoC Proof of Concept https://.com/carbon/admin/login.jsp?msgId=%27;alert1// Discoverers Name: Jackson Henry Twitter: @JacksonHHax Name: Nicholas Young...

CVE-2020-3580

CVE-2020-3580 Additional exploits for XSS in Cisco ASA devices discovered by PTSwarm Usage Stage address change me Demonstrate Logon to Cisco ASA WebVPN Visit staged malicious page Recover your credentials Patch ; Example / Result...

idm:DL1 security, bug fix, and enhancement update

An update is available for module.custodia, ipa, module.slapi-nis, module.bind-dyndb-ldap, opendnssec, module.ipa, module.opendnssec, bind-dyndb-ldap, module.softhsm, module.python-qrcode, python-yubico, ipa-healthcheck, python-jwcrypto, custodia, pyusb, module.python-kdcproxy, softhsm,...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. For educational purposes only Requires knowledge of loginURL, admin access or the...

XSSight

WARNING: This page is only for education, every malicious purpose from the users that are using it, will be punished with law rules! XSSight Cross-site Scripting XSS Cross-site Scripting XSS is an attack technique that involves echoing attacker-supplied code into a user's browser instance. A...

CVE-2023-41425

CVE-2023-41425 Description A Cross Site Scripting vulnerability in Wonder CMS Version 3.2.0 to Version 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This is a modifed version of the original exploit by prodigiousMind which...

CVE-2024-25292

RenderTune RCE A Proof-Of-Concept for CVE-2024-25292 vulnerability. A cross-site scripting XSS vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter. In this repository there is an example...

PwnXSS

A powerful XSS scanner made in python 3.7 Installing Requirements: BeautifulSoup4 pip install bs4 requests pip install requests python 3.7 Commands: git clone https://github.com/pwn0sec/PwnXSS chmod 755 -R PwnXSS cd PwnXSS python3 pwnxss.py --help Usage Basic usage: python3 pwnxss.py -u...

CVE-2015-9251

CVE-2015-9251 This repository contains a Proof of Concept PoC for CVE-2015-9251, a vulnerability in jQuery versions prior to 3.0.0 that allows attackers to perform Cross-Site Scripting XSS attacks under certain conditions...

Bootstrap-with-XSS

Bootstrap Historical Vulnerability PoC Collection This is a static HTML page for learning and research, which integrates multiple Proof of Concept PoC exploits for Cross-Site Scripting XSS vulnerabilities in the historical versions of the Bootstrap framework. This project aims to provide security...

cpanel_xss_2023

About the Tool ⚒️ cpanelxss2023 is a simple Python script designed for finding CVE-2023-29489 vulnerability and exploitability in cpanel. Features ⚙️ CVE-2023-29489 Scanning: Identifies and scans for the CVE-2023-29489 vulnerability and exploitation. URL Input: Supports scanning a single URL or...

Critical: Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update

An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability...

CVE-2023-30256

Webkul Qloapps 1.5.2 - Cross-Site Scripting XSS Webkul QloApps 1.5.2: Vulnerable to XSS on two Parameter emailcreate and back Exploit - Proof of Concept POC XXS: 'back' Parameter Payload Parameter back – Plain text: xss onfocus=alert1 autofocus= xss Payload Parameter back – URL Encoded:...