CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated

CVE-2022-40348: Intern Record System - Cross-site Scripting XSS no autenticado en 'name' y 'email' Título del Exploit: Intern Record System - Cross-site Scripting XSS no autenticado en 'name' y 'email' Fecha: 2022-06-09 Autor del Exploit: Hamdi Sevben Página del Vendedor:...

CVE-2017-6913

CVE-2017-6913 This is a vulnerability I found in open-xchange OX App Suite's webmail https://www.open-xchange.com/ a while back. Vulnerability details The webmail was vulnerable to a stored XSS when opening an email, due to the event attributes of the HTML time tag not being properly filtered...

CVE-2022-34962

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS Vulnerability Explanation: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting XSS vulnerability via the Group Timeline module. Attack Vectors: The attacker must post something on t...

CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files

Quick CMS Stored XSS v6.7 Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Files - Description in the Pages Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-44758_GDidees-CMS-Stored-XSS---Title

GDidees Stored XSS v3.0 Author: Sergio Description: Cross Site Scripting vulnerability in GDidees v.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Page Title. Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Page Title allows...

CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data in the Content Manager Menu. Attack Vectors:...

CVE-2025-55580

CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...

CVE-2019-17625

CVE-2019-17625 There is a stored XSS vulnerability in rambox 0.6.9 due to unsantized parameters in the name field when a user is adding a service. Since rambox runs on NodeJS this allows for the use of OS commands to be injected into an or tag. Note: This code has only been tested on MacOS and ma...

CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE File Upload XSS - WBCE v1.6.1 Author: Sergio Description: File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: A vulnerability in Media file upload sanitation allows you to upload a PDF file with hidden XSS. POC: When logging...

CVE-2024-5420-XSS

Description A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be...

CVE-2021-28079

CVE-2021-28079 - POC Jamovi file example.omv example.omv: Zip archive data, at least v2.0 to extract All OMV files are archived data. So, you can extract it and modify to exploit the XSS bug. root@kitploit: 🔥\ unzip example.omv Archive: example.omv inflating: META-INF/MANIFEST.MF inflating:...

CSPOC

Cobalt Strike Stored XSS RCE CVE-2022-39197 Runtime Parameters: -u: Cobaltstrike HTTP listener address, e.g., http://127.0.0.1:8500 -p: Payload, e.g., should not be too long Demonstration: Build command: go build -ldflags "-s -w" QQ Group: Click to join: 528118163 Join group / Cooperation / Conta...

Rukovoditel <= 2.7.2 - Cross Site Scripting

A stored cross site scripting XSS vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter. id: CVE-2020-35984 info: name: Rukovoditel = 2.7.2 - Cross Site...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

VvvebJs <= 2.0.5 - Cross-Site Scripting

Givanz Vvvebjs = 2.0.5 contains a stored XSS caused by manipulation of the "uploadAllowExtensions" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2026-5615 info: name: VvvebJs = 2.0.5 - Cross-Site Scripting author:...

WP Content Permission <= 1.2 - Cross-Site Scripting

The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. id: CVE-2023-26842 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site...