CVE-2026-105694

The open-source design and prototyping platform Penpot is vulnerable to Stored XSS in versions prior to 2.18.0 . Authenticated users with file-edit permission can upload SVG media containing unsanitized scripts, event-handler attributes, and foreignObject elements. Because these files are served ...

CVE-2026-105679

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 6.22.1 through 6.64.0 . The root cause is that the restriction on content types for uploaded files is not applied when using the default local storage adapter , allowing files to be served with content types deriv...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105651

The Ghost Node.js content management system (versions 5.94.0 through 6.64.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. When creating a bookmark card, the system could fetch and store non-image files from external websites as icons or thumbnails. This allowed staff users, includi...

CVE-2026-105650

The Ghost Node.js content management system (versions 2.1.0 through 6.64.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because embedding a URL from an attacker-controlled website can cause untrusted scripts to be stored within post content. These scripts can execute in ...

CVE-2026-105649

The Ghost Node.js content management system is vulnerable to Stored Cross-Site Scripting (XSS) in versions 4.22.0 through 6.65.0 . The root cause is a lack of sanitization for SVG media thumbnails and SVG images uploaded using non-SVG file extensions. This flaw allows any staff user, including Co...

CVE-2026-105644

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 4.0.0 through 6.67.0 . The root cause is the lack of sanitization for SVG images included during content imports. An attacker could trick an Administrator into importing a crafted file, enabling the execution of s...

CVE-2026-105643

The Ghost Node.js content management system (versions 6.34.0 through 6.67.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via embed cards in the editor. This flaw allows any staff user, such as a Contributor , to embed malicious scripts in post content. When another staff user opens that p...

CVE-2026-42700

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130...

CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension

CMSmadesimple 저장형 XSS v2.2.18 작성자: Sergio 설명: CMSmadesimple v.2.2.18의 XSS사이트 간 스크립팅 취약점으로 인해 로컬 공격자가 Extensions - MicroTiny WYSIWYG editor의 Profiles에 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: 스크립팅 - "MicroTiny WYSIWYG editor"의 Profiles 입력값 검증 취약점을 통해 사용자가 웹 페이지에 접근할 때 실행되는 JavaScript 코드를 주입할 수 있습니다...

CSPOC

Cobalt Strike 저장형 XSS RCE CVE-2022-39197 실행 매개변수: -u: Cobaltstrike HTTP 청취 주소, 예: http://127.0.0.1:8500 -p: Payload, 예: 너무 길지 않아야 합니다 데모: 빌드 명령: go build -ldflags "-s -w" QQ 그룹: 클릭하여 가입: 528118163 그룹 가입 / 협력 / 연락 왼쪽 | 공식 계정: 遮天实验室 오른쪽...

CVE-2021-24807

CVE-2021-24807 Support Board 3.3.4 인증된 저장형 XSS Support Board 버전 3.3.4의 Notes 매개변수를 통해 인증된 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 교차 사이트 스크립팅 취약점의 영향은 웹 애플리케이션마다 다릅니다. 세션 하이재킹부터 자격 증명 도용 및 기타 보안 취약점까지 이릅니다. 교차 사이트 스크립팅 취약점을 악용하면 공격자가 합법적인 사용자를 가장하여 계정을 탈취할 수 있습니다. 피해자 사용자가 관리자 권한을 가지고 있는 경우, 계정 및 웹 애플리케이션...

CVE-2026-100509 WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225...

EUVD-2026-92580

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225...

CVE-2026-100509

The RepairBuddy (computer-repair-shop) WordPress plugin, developed by Webful Creations , is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects version 4.1225 and all preceding versions. Exploitation of thi...

CVE-2023-4220-exploit

CVE-2023-4220-exploit /main/inc/lib/javascript/bigupload/inc/bigUpload.php의 대용량 파일 업로드 기능에서 Chamilo LMS = 1.11.24 버전의 제한 없는 파일 업로드는 인증되지 않은 공격자가 저장형 Cross Site Scripting 공격을 수행하고 웹 셸 업로드를 통해 원격 코드 실행을 얻을 수 있게 합니다. PoC bash CVE.2023.4220.sh -f webshell -u URL -l puerto 업로드된 파일은 다음 경로에서 확인할 수 있어야...

AdTran-Personal-Phone-Manager-Vulns

AdTran-Personal-Phone-Manager-Vulns 0데이 CVE-2021-25679, CVE-2021-25680, CVE-2021-25681에 대한 분석 문서를 호스팅하는 저장소입니다. 요약 CVE-2021-25679: Adtran Personal Phone Manager 인증된 저장형 XSS 이메일 주소 변경 폼 CVE-2021-25680: Adtran Personal Phone Manager 다중 반사형 XSS CVE-2021-25681: AdTran Personal Phone Manager DNS 정보 유출...

CVE-2026-105630

The Plane project management tool is vulnerable to Stored XSS in versions prior to 1.4.0 . An authenticated low-privilege user, such as a Guest, can upload an image/svg+xml file as an attachment. Because the file retains its attacker-controlled Content-Type and the asset-download endpoint provide...

CVE-2026-105630 Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a...

CVE-2022-31300

CVE-2022-31300 Haraj Script 3.7 - DM 섹션 인증된 저장형 XSS Exploit Title: Haraj Script 3.7 - 인증된 저장형 XSS Date: 2022-06-13 CVE: CVE-2022-31300 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://angtech.org/ Software Link: https://angtech.org/product/view/3 Version: 3.7 Tested on: LAMP, Ubunt...