CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 Este repositorio contiene exploits de prueba de concepto para CVE-2024-5836 y CVE-2024-6778, que son vulnerabilidades en el navegador web Chromium que permitían un escape de la sandbox desde una extensión del navegador. Para ejecutarlos, debes estar en una versión de...

WEAPONIZING-CVE-2024-4367

WEAPONIZING-CVE-2024-4367 CVE-2024-4367 es una vulnerabilidad crítica CVSS 9.8 en PDF.js, que permite la ejecución arbitraria de código JavaScript debido a comprobaciones de tipo insuficientes en el objeto FontMatrix dentro de archivos PDF. Asistente de Explotación CVE-2024-4367: Guía de Usuario...

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

Impact When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor. Patches Version 1.42.3 adds validation that prevents this attack. Workarounds No known workarounds...

cve-2024-4367-poc

CVE-2024-4367 POC para PDF.js PoC para la vulnerabilidad CVE-2024-4367 de PDF.js: el script pdf-modify.py se puede utilizar para modificar tus PDFs e inyectar payloads. Uso 1. Asegúrate de que CVE-2024-4367-POC-base-placeholder.pdf esté en el directorio de trabajo. 2. Descomenta/modifica la...

CVE-2024-4367

CVE-2024-4367 PoC Uso python poc.py mal.pdf "alert'0xr2r'" Referencias CVE-2024-4367: Ejecución arbitraria de JS en PDF.js PDF.js PoC Escáner plantillas...

CVE-2026-103662

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

Linux Distros Unpatched Vulnerability : CVE-2026-88060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, a...

MAL-2026-16056 Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

EUVD-2026-74074

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

WS-2019-0341

Cross-Site Scripting vulnerability found in nextcloud-vue-collections before 0.4.2. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's...

CVE-2024-29831

CVE-2024-29831 relates to an improper input validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server, potentially enabling remote code execution. Affected: DolphinScheduler; remediation guidance consistentl...

CVE-2024-5062

A reflected Cross-Site Scripting XSS vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

CVE-2024-4367 POC Usage bash python poc.py malicious.p...

CVE-2024-23320 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...

CVE-2024-23320 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...

CVE-2023-26045

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to...

PT-2023-20800

Name of the Vulnerable Software and Affected Versions Veritas NetBackUp OpsCenter version 9.1.0.1 Description The issue is related to Reflected Cross-site scripting XSS due to the Web App's failure to adequately sanitize special characters. This allows an attacker to execute arbitrary HTML and...

CVE-2023-22735

Zulip is an open-source team collaboration tool. In versions of zulip prior to commit "2f6c5a8" but after commit "04cf68b" users could upload files with arbitrary "Content-Type" which would be served from the Zulip hostname with "Content-Disposition: inline" and no "Content-Security-Policy" heade...

PT-2022-6685

Name of the Vulnerable Software and Affected Versions spaceLYnk versions 2.6.2 and prior Wiser for KNX formerly homeLYnk versions 2.6.2 and prior fellerLYnk versions 2.6.2 and prior Description A Cross-site Scripting issue exists, allowing an attacker to inject and execute arbitrary malicious...