CVE-2020-12625

CVE-2020-12625: Roundcube वेबमेल में दुर्भावनापूर्ण HTML अनुलग्नक के माध्यम से क्रॉस-साइट स्क्रिप्टिंग Roundcube के 1.4.4, 1.3.11 और 1.2.10 से पहले के संस्करणों में एक क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता मौजूद है। "text/html" अनुलग्नक वाले एक मेल में "" XML एलिमेंट का उपयोग करके, एक हमलावर...

CVE-2025-67730

CVE-2025-67730 – Межсайтовый скриптинг XSS с сохранением Обзор CVE ID: CVE-2025-67730 Тип уязвимости: Межсайтовый скриптинг XSS с сохранением Серьёзность: Средняя–Высокая зависит от контекста Данная уязвимость позволяла аутентифицированным пользователям внедрять вредоносный HTML и JavaScript в по...

CVE-2024-4367-Analysis

CVE-2024-4367: PDF.js में मनमाना जावास्क्रिप्ट निष्पादन अवलोकन CVE-2024-4367 PDF.js लाइब्रेरी में एक गंभीर भेद्यता है जो उपयोगकर्ता के ब्राउज़र में मनमाना जावास्क्रिप्ट निष्पादन की अनुमति देती है, जिससे क्रॉस-साइट स्क्रिप्टिंग XSS हमले होते हैं। यह Firefox उदाहरण: python3 poc.py "alert1" डेमो वीड...

CVE-2022-31297

CVE-2022-31297 Haraj Script 3.7 - Reflected XSS शोषण शीर्षक: Haraj Script 3.7 - Reflected XSS तारीख: 2022-06-13 CVE: CVE-2022-31297 शोषण लेखक: Abdulaziz Saad @b4zb0z विक्रेता होमपेज: https://angtech.org/ सॉफ्टवेयर लिंक: https://angtech.org/product/view/3...

CVE-2025-44998

CVE-2025-44998 Riepilogo Una vulnerabilità di cross-site scripting XSS memorizzato nel componente /tinyfilemanager.php di TinyFileManager v2.4.7 consente agli attaccanti di eseguire JavaScript o HTML arbitrario iniettando un payload appositamente creato nel parametro js-theme-3. PoC Per verificar...

CVE-2024-42009

CVE-2024-42009 – XSS Memorizzato in Roundcube PoC Docker 📌 Panoramica Questo repository dimostra un Proof-of-Concept PoC funzionante per CVE-2024-42009 , una vulnerabilità di Cross-Site Scripting XSS memorizzata in Roundcube Webmail. La vulnerabilità è causata da una sanitizzazione HTML impropria...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367: Esecuzione Arbitraria di JavaScript in PDF.js Questo progetto dimostra e analizza CVE-2024-4367 , una vulnerabilità ad alta gravità nella libreria PDF.js di Mozilla che permette l'esecuzione arbitraria di JavaScript attraverso un controllo inadeguato dei tipi nel codice di gestio...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Report di vulnerabilità del sito ufficiale del New Jersey Bootstrap 4.0.0 Trovato in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Informazioni sulla vulnerabilità: Media 28236 XSS nelle proprietà data-template, data-content e data-title di...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. id: CVE-2021-26702 info: name: EPrints 3.4.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: EPrints 3.4.2 contains a reflected cross-site...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /admin/ssl-fields/add.php Display Name, Description & Notes field parameters. id: CVE-2018-19751 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains...

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

ZZcms - Cross-Site Scripting

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. id: CVE-2020-20285 info: name: ZZcms -...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

ClinicCases 7.3.3 Cross-Site Scripting

ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. id: CVE-2021-38704 info: name:...

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. id: CVE-2021-40970 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

Grafana <= 6.7.1 - Cross-Site Scripting

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting XSS via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2024-9007 info: name: 123Solar 1.8.4.5 - Cross-Site Scripting author: ritikchaddha...