Lucene search
+L

142 matches found

Kitploit
Kitploit
added 2026/09/24 9:40 a.m.10 views

CVE-2023-4771

CKEditor AJAX 示例中的跨站脚本漏洞 CVE-2023-4771 PoC CKEditor 4 AJAX 示例中的跨站脚本(XSS)漏洞 本文档介绍如何使用 CKEditor 利用此 XSS 漏洞(CVE-2023-4771)。 请务必极其谨慎地按以下步骤操作: 先决条件 • 拥有对 CKEditor 实例的访问权限。 文件:ckeditor/samples/old/ajax.html。 利用 XSS 漏洞的步骤: 访问 CKEditor 示例页面 打开你常用的浏览器,访问此 URL:/ckeditor/samples/old/ajax.html。该 URL 应指向被测 We...

6.1CVSS6.7AI score0.00878EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.23 views

Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting

Dyn Business Panel WordPress plugin = 1.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter in output, letting attackers execute scripts in the context of high privilege users, exploit requires victim to click a malicious link. id: CVE-2024-130...

8.1AI score0.00537EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.54 views

Widget4Call WordPress - Cross-Site Scripting

Widget4Call WordPress plugin = 1.0.7 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13099 info: name:...

8.3AI score0.00693EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.61 views

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

8.1AI score0.00594EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.23 views

Guten Free Options - Cross Site Scripting

Guten Free Options WordPress plugin = 0.9.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click malicious link. id: CVE-2024-13492 info: name: Guten Free...

8.2AI score0.00584EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.24 views

AffiliateImporterEb <= 1.0.6 - Reflected XSS

AffiliateImporterEb WordPress plugin through 1.0.6 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12732 info: name: AffiliateImporterEb =...

5.9AI score0.00573EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.24 views

WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

5.9AI score0.00573EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.36 views

OWL Carousel Slider - Cross-Site Scripting

OWL Carousel Slider WordPress plugin v2.2 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft malicious URL. id: CVE-2024-13627 info:...

8.3AI score0.00838EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.27 views

iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting

iBuildApp WordPress plugin through 0.2.0 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13326 info:...

8.1AI score0.00584EPSS
SaveExploits1References2
NVD
NVD
added 2026/09/16 6:16 a.m.14 views

CVE-2026-86784

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

6.8CVSS0.00431EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/10 4:18 a.m.9 views

CVE-2026-4657

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

6.4CVSS0.00419EPSS
SaveExploits0References11
CVE
CVE
added 2026/09/05 6:00 a.m.13 views

CVE-2026-84935

The HT Menu WordPress plugin (versions before 1.2.7 ) is vulnerable to a Stored XSS vulnerability. The flaw exists because the plugin fails to perform capability or object-ownership checks when saving navigation menu-item settings and fails to escape those settings during rendering. This allows u...

5.3AI score0.00413EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/05 6:00 a.m.11 views

CVE-2026-82846 Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

5.9AI score0.00431EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/05 6:00 a.m.11 views

EUVD-2026-71857

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

5.3AI score0.00431EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/31 10:51 a.m.16 views

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

5.1CVSS5.8AI score
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/08/30 12:00 a.m.20 views

PT-2026-83523

Name of the Vulnerable Software and Affected Versions SOGO Add Script to Individual Pages Header Footer versions prior to 4.0 Description The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox. Additionally, it does not restrict these actions to...

6.8CVSS5.3AI score0.00229EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/27 2:50 p.m.15 views

EUVD-2026-67050

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

9.3CVSS5.4AI score0.0025EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/27 12:00 a.m.19 views

PT-2026-82385

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

5.6AI score0.00138EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/16 12:31 a.m.13 views

EUVD-2026-59795

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

9.4CVSS6.5AI score0.00643EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/15 10:16 p.m.11 views

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

9.4CVSS0.00643EPSS
SaveExploits0References2
Rows per page
Query Builder