17079 matches found
portswigger-labs-writeups
portswigger-labs-writeups Complete writeups for P...
PT-2025-54307
Name of the Vulnerable Software and Affected Versions Genetech Products Web and WooCommerce Addons for WPBakery Builder versions through 1.5 Description The software contains a flaw related to improper input handling during web page creation, leading to a DOM-Based Cross-site Scripting issue. Thi...
WordPress Real 3D FlipBook plugin cross-site scripting vulnerability
WordPress Real 3D FlipBook plugin is a plugin for WordPress website, which uses WebGL technology to convert PDF files or images into flipbook animations with realistic 3D effects, simulating the page turning experience of a real book, including page bending, light and shadow and shadow effects...
CVE-2025-57462
Stored cross-site scripting xss in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file...
Exploit for Deserialization of Untrusted Data in Facebook React
No d...
Cross-site Scripting (XSS)
Overview httpbin is a HTTP Request and Response Service Affected versions of this package are vulnerable to Cross-site Scripting XSS via the endpoint /base64 which does not encode user-controllable parameters when outputting them on the current page. An attacker can inject and execute arbitrary...
Kentico Xperience Email Marketing Template Cross-Site Scripting Vulnerability
Kentico Xperience is a digital experience platform from Kentico. A cross-site scripting vulnerability exists in the Kentico Xperience email marketing templates, which can be exploited by attackers to execute malicious scripts that can compromise a user's browser and steal sensitive information...
PT-2025-52760
Hackers Exploit List-Unsubscribe Header for XSS and SSRF Attacks The List-Unsubscribe SMTP header can be exploited for XSS and SSRF attacks if not properly validated. Examples include Horde Webmail CVE-2025-68673 allowing JavaScript URIs and Nextcloud Mail risking SSRF. Proper validation,...
CVE-2025-67291
A stored cross-site scripting XSS vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field...
web-security-vulnerability-labs
web-security-vulnerability-labs This repository documents han...
CVE-2020-36891 Kentico Xperience <= 12.0.49 File Upload Stored XSS
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute i...
CVE-2025-60043
The CVE-2025-60043 entry concerns the WordPress Wanderic theme (
CVE-2025-58946 WordPress Vocal theme <= 1.12 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Vocal vocal allows PHP Local File Inclusion.This issue affects Vocal: from n/a through = 1.12...
PT-2025-52255
Name of the Vulnerable Software and Affected Versions Dify version 1.9.1 Description A Cross-Origin Resource Sharing CORS misconfiguration exists in the /console/api/system-features endpoint. The endpoint has an overly permissive CORS policy that reflects arbitrary Origin headers and sets...
Exploit for CVE-2015-1427
Penetration Testing Framework !License: MIThttps://img.sh...
CVE-2025-68163
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page...
CVE-2025-68062
CVE-2025-68062 — WordPress MinimogWP theme <= 3.9.6 suffers an improper filename handling vulnerability allowing PHP Local File Inclusion via Include/Require in the PHP program (PHP Remote File Inclusion). The issue is classified as a high-severity vulnerability (CVSS v3.1 base score 7.5) with...
📄 Craft CMS 5.0 Twig Template Injection Scanner
This is a mass scanning script for the Craft CMS version 5.0 Twig template injection vulnerability. ============================================================================================================================================= | Title : Craft CMS 5.0 Twig Template Injection – Mass...
📄 Hestia Control Panel 1.9.3 Code Execution
Hestia Control Panel version 1.9.3 code injection proof of concept exploit written in PHP that leverages cronjobs. ============================================================================================================================================= | Title : Hestia Control Panel 1.9.3 PHP...