CVE-2026-57829

Helix Ultimate Framework — Unauthenticated Stored XSS comajax → Admin Session-Riding → Full Account Takeover This is the strongest finding in this research folder — CRITICAL, fully confirmed end-to-end. Unlike the delete-only bug in helixultimatedeletepoc.md, this one has a real, working path to...

Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-

Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212- Download files from my repostry using git clone git clone https://github.com/JasaluRah/Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-.git now to set docker image Creating docker image use the command sudo docker build -t work . To...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

CVE-2025-55287-POC

CVE-2025-55287-POC Authenticated Stored Cross-Site Scripting XSS in Genealogy app prior to 4.4.0 allows arbitrary JavaScript execution and privilege escalation from Editor+ role to Administrator. Summary Vulnerability type: Stored Cross-Site Scripting CWE-79 Affected component: 'Person' firstname...

CVE-2024-57175

CVE-2024-57175: Stored Cross-Site Scripting XSS in PHPGURUKUL Online Birth Certificate System v1.0 Description A stored Cross-Site Scripting XSS vulnerability was identified in PHPGURUKUL Online Birth Certificate System v1.0 in the /user/certificate-form.php page. This vulnerability allows...

XXStrike

XXStrike cat README.md ⚡ XXStrike v2.0 Next-Generation XSS Cross-Site Scripting Scanner & Fuzzing Suite Developed by: Maxod anonmoty 🔰 Official Repository: https://github.com/anonmoty/XXStrike Overview • Key Features • Modules • Installation • Usage • Comparison • Disclaimer 📌 Overview XXStrike i...

CVE-2022-47373

CVE-2022-47373 Reflected Cross Site Scripting Vulnerability in PandoraFMS Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Gaurish Kauthankar Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: Tested on: Ubunt...

CVE-2022-31889

CVE-2022-31889 for osTicket | Support Ticketing System Reflected XSS http://localhost/scp/audits.php?startData=&endDate=&type="alert'reflectedXSS'...

CVE-2025-51863

CVE-2025-51863 Vulnerability description ChatGPTUtil is a AI-powered chatbot assistant, providing access to both ChatGPT and an AI image generator. A Self Cross-Site Scripting Self-XSS vulnerability exists in the chat component. This can lead to cookie theft leading to remote account hijacking...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

ppmap

ppmap A simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets checks for specific variables in the global context to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advance...

CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL SUMMARY PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting XSS via the pricefrom and priceto GET...

the-book-of-secret-knowledge

"Knowledge is powerful, be careful how you use it! " A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more. 📔 What is it? This repository is a collection of various materials and tools that I use every day in my work. It contains a lot of useful...

Reflected-XSS-on-Opentext-Portal-v7.4.4

Cross-site scripting XSS vulnerability in OpenText Portal v7.4.4 allows remote attackers to inject arbitrary web script or HTML code via the vgnextoid URI parameter. Attack vector: Javascript injection in vgnextoid parameter preceded of "--" html comment closing sequence RESULT: Found by Héctor...

xssmap

2020.08.20 update There are still a lot of bugs, so I'll take the time to fix them soon, so please keep updating. XSSMAP Detect XSS vulnerability in Web Applications Usage mimics sqlmap, and if you know sqlmap, you can easily handle xssmap! 中文介绍 Screenshots Easy Installation As simple as below,...

CVE-2025-65640

CVE-2025-65640 1. Vulnerability Information CVE ID: CVE-2025-65640 Currently RESERVED Vulnerability Type: Stored Cross-Site Scripting XSS CVSSv3 score: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Vendor: Arket/Bluenext S.r.l. Product: Globe Document Intelligence Affected Version: 5.0.0.559 Discoverer...

CVE-2025-26244

CVE-2025-26244-POC The code to exploit this vulnerability can be seen in 'spoof.go'. This imitates as an agent to the C2 server. In order to run this vulnerability we need to know: 1. The listener IP address and Port 2. The public key of the listener. 3. The first time check in URL of the listene...

Papers

This repository is intended to host my research papers. Put it on watch if you would like to read more from me. Bypassing XSS Detection Mechanisms Download PDF A Phonetic Approach to Calculate Linguistic Information in Text Download PDF...

CVE-2025-7431

Proof of Concept – CVE-2025-7431 Knowledge Base = 2.3.1 - Authenticated Administrator+ Stored Cross-Site Scripting via Plugin Slug CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N ------- 4.4 Vulnerability Overview An authenticated attacker Administrator can exploit a Stored Cross-Site Scripting XSS...

CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross-site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote...