html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...

CVE-2026-75684

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-93981

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

EUVD-2026-84790

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

EUVD-2026-84780

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

EUVD-2026-84779

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-95657

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

osbuild-composer security update

An update is available for osbuild-composer. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images an...

CVE-2026-95657

The dgtlmoon Changedetection.io application is vulnerable to cross-site scripting (XSS) in versions up to 0.55.8 . The flaw exists in the setCurrentSelectedText function of the changedetectionio/static/js/visual-selector.js file within the Visual Selector component. A remote attacker can trigger ...

EUVD-2026-84604

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2019-10092

CVE-2019-10092: Apache HTTP Server의 "Proxy Error" 페이지를 통한 제한적 크로스 사이트 스크립팅 Apache HTTP Server 2.4.0-2.4.39에서 modproxy 오류 페이지에 영향을 주는 제한적 크로스 사이트 스크립팅 문제가 보고되었습니다. 공격자는 오류 페이지의 링크를 잘못된 형태로 만들어 자신이 선택한 페이지를 가리키도록 할 수 있습니다. 이 취약점은 프록시가 활성화되어 있지만 Proxy Error 페이지가 표시되도록 잘못 구성된 서버에서만 악용될 수 있습니다. 공급업체 공...

CVE-2020-17453-PoC

CVE-2020-17453 WSO2 Management Console 5.10 버전까지는 carbon/admin/login.jsp의 msgId 매개변수를 통해 XSS가 허용됩니다. PoC 개념 증명 root@kitploit: https://.com/carbon/admin/login.jsp?msgId=%27;alert1// 발견자 이름: Jackson Henry 트위터: @JacksonHHax 이름: Nicholas Young...

Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc

Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc WolfCMS-v0.8.3.1 크로스 사이트 스크립팅XSS 할당된 CVE 번호: CVE-2017-11611...

CVE-2023-30256

Webkul Qloapps 1.5.2 - 크로스 사이트 스크립팅 XSS Webkul QloApps 1.5.2: 두 개의 매개변수emailcreate 및 back에서 XSS 취약점 익스플로잇 - 개념 증명 PoC XXS: 'back' 매개변수 root@kitploit: Payload Parameter back – Plain text: xss onfocus=alert1 autofocus= xss Payload Parameter back – URL Encoded:...

Joplin-CVE-2022-35131

Joplin CVE-2022-35131 Joplin のバージョン 2.8.8 以前に影響する、RCE につながる XSS。Windows および Linux でテスト済みで動作します。 報告および修正: 2022-06 技術概要 1. JavaScript ペイロードをタイトルとしてメモを作成する（POC は以下を参照） 2. Ctrl+P を押して、ノートまたはタイトル内の何かを検索する 3. 検索結果に表示されるとペイロードが実行される 4. ノートブックを共有することでリモートコード実行が可能になる 問題は、GotoAnything.tsx の 509...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 본인이 발견한 취약점 CVE-2019-15053 권고: advisory.txt 기본 정보 root@kitploit: Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and before Tested Versions....: 1.4.2...

CVE-2023-30212-LAB

취약한 Docker 환경 만들기 CVE-2023-30212 설명 CVE-2023-30212는 OURPHP 버전 7.2.0 이하에 영향을 미치는 보안 취약점입니다. 이 취약점은 교차 사이트 스크립팅XSS 공격을 허용합니다. OURPHP 단계 Dockerfile 다운로드 dockerfile을 다운로드한 폴더에서 터미널 열기 머신에 Docker 설치 kali@kali:$sudo apt install -y docker.io 새 Docker 이미지 만들기 kali@kali:$docker build -t test 새 Docker 컨테이너...

xss_vulnerability_challenges

Сценарии XSS-уязвимости задачи Этот репозиторий представляет собой Docker-приложение на PHP, содержащее несколько задач по XSS-уязвимостям. Идеи, лежащие в основе задач: Обход проверки JavaScript Обход HTML-сущностей Обход WAF Обход проверки черного списка Обход базовой проверки XSS Обход WAF с...