EUVD-2026-104814

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

CVE-2026-110306

The fast-uri Node.js URI parser and serializer is vulnerable to URI scheme spoofing in versions before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2. The root cause is that the library uses the legacy global unescape() function to percent-decode the scheme component before validation. This ...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

EUVD-2026-104811

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.0 . The root cause is insufficient input sanitization and output escaping within the update_license AJAX Action. This allows authenticated attackers with subscribe...

CVE-2026-93878 DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

WordPress DiviGear Carousel plugin <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Austin Ginder in WordPress Plugin DiviGear Carousel versions = 5.2.0...

WordPress WP Photo Album Plus plugin < 9.2.11.002 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Photo Album Plus versions 9.2.11.002...

CVE-2024-7646

CVE-2024-7646 PoC CVE-2024-7646 apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: | addheader X-Pwn-Header "Pwn\r\n HTTP/1.1 200 OK Content-Type: text/html alert'XSS'; --------"; return 200 "PWNed"; spec: rules:...

teler-waf

teler-waf teler-waf is a comprehensive security solution for Go-based web applications. It acts as an HTTP middleware, providing an easy-to-use interface for integrating IDS functionality with teler IDS into existing Go applications. By using teler-waf, you can help protect against a variety of...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

EUVD-2026-104810

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

CVE-2026-112148

A DOM-based cross-site scripting (XSS) flaw exists in the LIFF SDK versions 2.20.0 through 2.31.0 . An attacker can execute arbitrary JavaScript within the origin of an affected LIFF application's endpoint by tricking a user into opening a specially crafted URL in an external browser. This could ...

CVE-2026-112148

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

CVE-2023-30212-Lab

CVE-2023-30212-Lab GitHub repository with Dockerfile and files to create a vulnerable environment for CVE-2023-30212, enabling exploration of the exploitability of this security vulnerability. Ideal for research and security enthusiasts to study and understand the impact of the vulnerability in a...

JSFScan.sh

JSFScan.sh Blog can be found at https://medium.com/@patelkathan22/beginners-guide-on-how-you-can-use-javascript-in-bugbounty-492f6eb1f9ea?sk=21500dc4288281c7e6ed2315943269e7 Script made for all your javascript recon automation in bugbounty. Just pass subdomain list to it and options according to...

CVE-2025-46173

CVE-2025-46173 - Stored Cross-Site Scripting XSS in Online Exam Mastering System 1.0 📌 Summary CVE-2025-46173 is a stored Cross-Site Scripting XSS vulnerability discovered in the Online Exam Mastering System 1.0 by code-projects. The vulnerability exists in the feedback.php component where user...

CVE-2025-51398

Exploit Title: LiveHelperChat 5. S...

CVE-2021-35956

CVE-2021-35956. Proof of Concept Exploit for CVE-2021-35956, AKCP sensorProbe - 'Multiple' Cross Site Scripting XSS. Exploit Title: AKCP sensorProbe - 'Multiple' Cross Site Scripting XSS. Date: 07-01-2021. Exploit Author: Tyler Butler. Vendor Homepage: https://www.akcp.com/. Software Link:...