CVE-2025-60654

CVE-2025-60654 - Хранимый межсайтовый скриптинг XSS в описании объявления | ---|--- Исследователи| DotAdrien Уровень опасности| 7.2 ВЫСОКИЙ CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Программное обеспечение...

CVE-2026-86772

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting (XSS) vulnerability in DepartmentPresenter::formattedNameLink() . Department names are rendered unescaped in the fallback branch shown to users lacking the departments.view permission. An attacker with departments.edit permissio...

CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

EUVD-2026-74949

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

EUVD-2026-74918

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — OpenKM v6.3.12 저장형 XSS 취약점 발견 및 보고자:Dharmendra Kumar — 보안 연구원 사이버 보안 | 침투 테스트 | 취약점 연구 | 책임 있는 공개 📌 목차 개요 CVE 세부 정보 영향받는 제품 취약점 설명 근본 원인 분석 영향 및 위험 평가 개념 증명 PoC...

joomla_exploits

Joomla 익스플로잇 이 저장소는 실제 Docker Joomla 환경에서 검증된 선별된 Joomla 익스플로잇 아티팩트를 포함합니다. 컬렉션은 실용적인 공격 유용성에 따라 분류됩니다. 실제 영향 real-impact 직접적인 보안 영향을 가진 익스플로잇: RCE, 파일 업로드를 통한 코드 실행, SQL 인젝션, 민감한 구성 정보 노출, 임의 파일 삭제, 관리자 대상 Stored XSS, 권한 상승...

osticket-stored-xss-security-assessment

CVE-2026-36214 - Bootstrap Tooltip を介した osTicket の保存型XSS コンサルタント形式のサイバーセキュリティレポート osTicket の保存型クロスサイトスクリプティングに関するプロフェッショナルな脆弱性評価レポート。ビジネスへの影響、是正措置、緩和戦略を含みます。 📍 レポート概要...

CVE-2026-87812

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 익스플로잇 제목: Vehicle Service Management System - 'MyAccount' 저장형 크로스 사이트 스크립팅 XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIUM 참고 자료: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

CVE-2022-47131

CVE-2022-47131 Academy LMS history.pushState'', '', '/'...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 Exploit Title: Vehicle Service Management System - 'Service Requests' 저장형 교차 사이트 스크립팅 XSS Exploit Author: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM 참조: https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss...

CVE-2021-25790-Multiple-Stored-XSS

CVE-2021-25790-Multiple-Stored-XSS: Множественные хранимые XSS в House Rental and Property Listing V1.0 Software Ссылка: https://www.sourcecodester.com/download-code?nid=14649&title=House+Rental+and+Property+Listing+in+PHP+with+Full+Source+Code https://vulners.com/cve/CVE-2021-25790...

CVE-2026-87814

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the search asset preview feature. The root cause is a failure to escape indexed asset content before inserting it into the DOM via innerHTML . An attacker who can place crafted text assets in a workspace can ...

EUVD-2026-74839

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

EUVD-2026-74840

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...