395 matches found
CVE-2017-7089
CVE-2017-7089 Impact : Processing maliciously crafted web content may lead to universal cross site scripting Description : A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management. Safari 10 Local SOP bypass function Pewvar...
CVE-2017-5124
CVE-2017-5124 UXSS with MHTML DEMO: https://bo0om.ru/chromepoc/PoC.php tested on Chrome/61.0.3163.100...
CVE-2021-43530-UXSS-On-QRcode-Reader-
CVE-2021-43530-UXSS-On-QRcode-Reader- CVE-2021-43530 A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. This bug only affects Firefox for Android. Other operating systems are unaffected.. This...
the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss
CVE-2026-78997 — Универсальный XSS UXSS в UC Browser для Android Материалы PoC для CVE-2026-78997 — универсальный межсайтовый скриптинг в UC Browser для Android com.UCMobile.intl, версия 13.7.8.1314, раскрытый Omri Inbar Novee. Отражённый XSS на домене mtmsg.uc.cn, внесённом в белый список моста,...
RP_DCP_Code_Exec
Real Player 'DCP://' URI Remote Arbitrary Code Execution Vulnerability видео-демонстрация: https://youtu.be/AMODp3iTnqY Схема URI 'DCP://' — это внутренний протокол, используемый Real Player для получения URL-адресов, отображаемых на вкладке браузера плеера. Она расшифровывается как 'Data Cache...
DEBIAN-CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
EUVD-2026-77932
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-86898
A logic issue exists in the WebKit component of Safari 27 , iOS 27 , iPadOS 27 , macOS Golden Gate 27 , and visionOS 27 . The root cause is a flaw in state management that can be triggered by opening a maliciously crafted webarchive file . This vulnerability may lead to universal cross-site scrip...
PT-2026-91698
Name of the Vulnerable Software and Affected Versions Safari versions prior to 27 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 visionOS versions prior to 27 Description A logic issue involving state management allows for universal cross-site scriptin...
CVE-2026-78997
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
EUVD-2026-72670
NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...
CVE-2026-78997
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
EUVD-2026-72957
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
PT-2026-87176
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
CVE-2026-78997
UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...
CVE-2026-78997
UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314 ) is vulnerable to a Universal Cross-Site Scripting (UXSS) flaw. The issue stems from a reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn, which allows attackers to access the privileged ucapi JavaScript bridge. Speci...