309 matches found
API-attack-detection-with-AI
Detection of SQL/XSS Attacks on Web API with Artificial Intelligence / Machine Learning This project aims to detect SQL and XSS injections in API requests/params using machine learning. Project Overview This project aims to detect SQL and XSS injections in API requests and parameters using Machin...
CVE-2025-8191
CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...
WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Md. Minaruzzaman Shovon in WordPress Plugin Bold Page Builder versions 5.9.8...
MGASA-2026-0341 Updated golang packages fix security vulnerabilities
CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...
CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...
CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...
BIT-GOLANG-2026-56858 Fix Javascript regexp context tracking in html/template
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CVE-2026-14290
The Embed Google Photos album WordPress plugin (versions through 2.2.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape a shortcode attribute value before outputting it within an HTML attribute. This allows users with the Contributor role or higher to...
CVE-2026-56858
The golang programming language, specifically the html/template package, is vulnerable to a flaw where pathological inputs can cause an unescaped '/' to be closed early. This allows attackers to inject arbitrary content, potentially leading to Cross-Site Scripting (XSS) . This vulnerability impac...
CVE-2026-49864 wetty vulnerable to DOM XSS via file-download filename
wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...
CVE-2026-44762
CVE-2026-44762 describes a misconfigured Content Security Policy in SAP Data Services Management Console. The overly permissive CSP and lack of restrictive directives could enable an authenticated attacker, in combination with another vulnerability, to inject and execute scripts in the applicatio...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of breadcrumbs in the page list view. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious input into the breadcrumb display. Details Cross-site...
Exploit for Improper Access Control in Ollyo Helix3
-CVE-2026-49049-Helix3-Expl...
Important: php8.5
Issue Overview: PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes. CVE-2026-42371 In uriparser before 1.0.2, there is pointer...
CVE-2019-20381
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491...
CVE-2025-8386
The vulnerability, if exploited, could allow an authenticated miscreant with privilege of "aaConfigTools" to tamper with App Objects' help files and persist a cross-site scripting XSS injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The...
EUVD-2019-2740
Malware in sbrugna...
EUVD-2019-17688
Malware in sbrugna...