CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: forced Xalan TransformerFactory drops the JAXP external access restrictions Runnable proof-of-concept reproducer for the Apache Camel Quarkus vulnerability where the XSLT support extension camel-quarkus-support-xalan supplies its own Xalan-backed TransformerFactory...

Magento-ver.-2.4.6

Exploit Title: FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection Date: 2023-11-17 Exploit Author: tmrswrr Vendor Homepage: FireBear Studio Software Link: FireBear Studio Improved Import & Export Version: FireBear Improved Import & Export ver. 3.8.6...

CVE-2022-34169

CVE-2022-34169 PoC A malleable PoC and solution for the SUpwn challenge from SUCTF 2025. Based on this issue from the original discoverer Felix Wilhelm and this blog post thanat0s. Tries not to rely as much on hard constants as the existing PoCs out there. If you want to deliver a different java...

mirth-connect-security-poc

NextGen Connect 4.5.2 vulnerability PoCs Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect Mirth Connect 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a...

AutoGenerateXalanPayload

AutoGenerateXalanPayload Introduction This is an automated payload generation tool for the JDK Xalan overflow vulnerability CVE-2022-34169. It was created because different JDK versions require different overflow payloads. Running this tool with different JDK versions will generate different XSLT...

CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via XSLT injection in Lutece Core Explanations and more on my website /xsl:styleshee...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – XSLT Server‑Side Injection via xsl:script Program Code Python + XSLT xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml = request.form'xml' xslt =...

NetSec-CVE-2023-4357

Network Security Project — CVE-2023-4357 Overview This project is a final project for a Network Security course. The project focuses on CVE-2023-4357, a vulnerability affecting Google Chrome versions prior to 116.0.5845.96. The vulnerability is related to the handling of XML/XSLT and can allow a...

CVE-2019-25137-Version-Research

CVE-2019-25137 Affected Version Research CVE-2019-25137 Overview CVE-2019-25137 is a XSLT injection vulnerability in Umbraco CMS. The vulnerability is present in the XSLT Extensive Stylesheet Language Transformations Visualizer webpage. The vulnerable URI for this webpage is...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792421834)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792421834 advisory. - Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17,...