Leantime-POC

Leantime-POC CVE-2024-27474, CVE-2024-27476, CVE-2024-27477 Description The following vulnerabilities were identified in version 3.0.6 of the Leantime goals focused project management system. CVE-2024-27474 A cross-site request forgery CSRF vulnerability which, when triggered, would create and...

PwnXSS

A powerful XSS scanner made in python 3.7 Installing Requirements: BeautifulSoup4 root@kitploit: pip install bs4 requests root@kitploit: pip install requests python 3.7 Commands: root@kitploit: git clone https://github.com/pwn0sec/PwnXSS chmod 755 -R PwnXSS cd PwnXSS python3 pwnxss.py --help Usag...

CVE-2019-10779

CVE-2019-10779 GCHQ Stroom is vulnerable to Cross-Site Scripting due to the ability to load the Stroom dashboard on another site and insufficient protection against window event origins...

CVE-2026-81635

SHIRASAGI by Security Science is affected by a cross-site scripting (XSS) vulnerability that may allow an attacker to execute arbitrary script in the web browser of a user who accesses a website using the product. The CNA (JPCERT) assigns a MEDIUM severity (CVSS 3.0 base score 5.4; CVSS 4.0 base ...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

EUVD-2026-75271

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-82925

Site Reviews WordPress plugin versions 7.2.2 through 8.2.2 (before 8.3.0) allow unauthenticated PHP object injection via a deserialization flaw in its form-signature handling. The plugin derives its protection key by padding the site's WordPress nonce key , making it publicly computable when that...

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-78361 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

EUVD-2026-75263

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin versions 1.1.0 through 1.1.2 fails to validate the tgwcfb_id parameter during registration, reading the permitted-role allow-list from an arbitrary attacker-controlled post rather than a legitimate registration form. A user with Contributor o...

EUVD-2026-75267

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2024-10605

Affected Version: BloodBank Management System : 1.0 Vulnerability Information: Vulnerability Type: Cross Site Request Forgery CSRF Severity: HIGH Status: Unpatched Vulnerable Endpoint: Path: file/request.php Vulnerability Description: There is a Cross Site Request Forgery on this endpoint...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. Description : Exploiting a Cross-site request forgery CSRF attack to create a privileged user through the Webmin's add users feature then getting a reverse shell through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version...

CVE-2022-30513

CVE-2022-30513 School Dormitory Management System 1.0 - Reflected XSS Exploit Title: School Dormitory Management System 1.0 - Reflected XSS Date: 2022-05-25 CVE: CVE-2022-30513 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2024-48589

phpAbook 9.0i - Cross-Site Scripting XSS Vulnerability CVE-2024-48589 Summary: A Cross-Site Scripting XSS vulnerability was discovered in the rol parameter of index.php or the path section in the phpAbook application. This vulnerability allows an attacker to inject arbitrary JavaScript code into ...

CVE-2023-50465

MonicaHQ XSS Exploitation of MonicaHQ XSS Create an account Create a contact In Documents, upload a malicious SVG file root@kitploit: alert"Monicahq XSS Poc"; Access the uploaded file...

Academy Learning Management System <5.9.1 - Cross-Site Scripting

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress BackupBuddy <8.8.3 - Cross Site Scripting

WordPress BackupBuddy plugin before 8.8.3 contains a cross-site vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in various locations. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected...