WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. id: CVE-2019-17231 info: name: WordPress OneTone theme = 3.0.6 – Unauthenticated Stored XSS author: daffainfo severity: medium description: | includes/theme-functions.php in the OneTone...

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Users Alerts feature /index.php?module=usersalerts/usersalerts of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add". id:...

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Nam...

Rukovoditel <= 3.2.1 - Cross-Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add Page function at /index.php?module=helppages/pages&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title fiel...

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add Announcement function at /index.php?module=helppages/pages&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

Yamcs <=5.8.6 - Cross-Site Scripting

Yamcs 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirecturi parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL. id: CVE-2026-55549 info: name: Yamcs =5.8.6 -...

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...

ChurchCRM v4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-31548 info: name: ChurchCRM v4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Dashboard Configuration feature index.php?module=dashboardconfigure/index of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Ad...

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Variables feature /index.php?module=globalvars/vars of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create". id:...

Rukovoditel <= 3.2.1 - Cross-Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...

CVE-2026-15253

CVE-2026-15253 Easy Media Replace = 0.2.0 - 認証済み（Author+）Stored Cross-Site Scripting 説明 Easy Media Replace プラグインは、メディア添付ファイルのタイトルを介した Stored Cross-Site Scripting（XSS）に対して脆弱です。Author が XSS ペイロードを使用してメディアファイルの名前を変更し、Admin または Editor がリストビューのメディアライブラリに移動して「Replace」リンクにホバーすると、ペイロードが実行されます。これは、プラグインが...

CVE-2024-46538

この投稿は、EQSTLab によって公開された調査記事です。 この脆弱性を発見したphysicszq に感謝します。 CVE-2024-46538 ★ CVE-2024-46538 PfSense 保存型XSSによる任意コード実行 PoC ★ https://github.com/user-attachments/assets/f41d0945-b7f4-4f88-bac5-265904256aae 説明 CVE-2024-46538 : PfSense 保存型XSSの脆弱性 説明: pfsense v2.5.2 のクロスサイトスクリプティング XSS 脆弱性により、攻撃者は...

CVE-2019-12475

CVE-2019-12475 MicroStrategy Web 10.4.6以前における保存型XSS 作者: undefinedmode https://github.com/undefinedmode/CVE-2019-12453 メトリックにおける保存型XSSで、Visual Thresholdエディタを開くときにトリガーされます。2017年にベンダーに報告され、バージョン10.4.6ですぐに修正されました。...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2019-15858

CVE-2019-15858 Woody Ad Snippets における認証不要のリモートコード実行 PoC 脆弱性は nintechnet によって発見され、エクスプロイトは GeneralEG と X-Vector によって公開されました。 認証不要のオプションインポート脆弱性と保存型XSS脆弱性が組み合わさることで、WordPress Woody Ad Snippets（アクティブインストール数90,000以上）においてリモートコード実行につながる可能性があります。 Woody Ad Snippets...

Moodle-CVE-2019-3810

Moodle CVE-2019-3810 Moodle 3.6.2, 3.5.4, 3.4.7, 3.1.16 XSS PoC for Privilege Escalation Student to Admin. これは、私が過去に学術機関でのペネトレーションテスト中に発見したバグの一つです。当時、この単純なバグ一つで実質的に管理者アクセスを盗み、Moodleを完全に制御することができました。 git historyからわかるように、このバグはMoodleの旧バージョン（2003年）から存在し、2019年に修正されました。 タイムライン: 2018年12月 - Moodleにバグを報告...

CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...