EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

CVE-2026-107586 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-101157

A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...

CVE-2026-101157 Security Advisory 0192

A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...

CVE-2026-101157 Security Advisory 0192

A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...

CVE-2026-101157

A stored cross-site scripting (XSS) vulnerability exists that may allow an unauthenticated attacker with adjacent-network access to inject malicious content. This content executes when an authenticated user views the affected content, potentially allowing the attacker to compromise the victim's a...

CVE-2026-102576

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

EUVD-2026-92519

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2023-0264

CVE-2023-0264에 대한 PoC 권한 부여 코드 흐름 중 세션 하이재킹을 허용하는 Keycloak 취약점 https://github.com/advisories/GHSA-9g98-5mj6-f9mv 참조 전제 조건 Docker curl jq python3 또는 HTTP로 정적 파일을 제공하는 다른 도구 재현 단계 1. ./run-keycloak-container.sh로 Keycloak 컨테이너를 시작합니다. 2. ./create-users.sh로 사용자 alice와 mallory 두 명을 생성합니다. 3. 이 저장소의 정적...

CVE-2026-102295: Improper Neutralization of Input During Web Page Generation

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

trawl

TRAWL TRAWL에 오신 것을 환영합니다! 👋 애플리케이션과 AI 에이전트를 위한 자체 호스팅 웹 스크래핑. 네이티브 API를 통해 페이지를 가져오거나, MCP 클라이언트를 연결하여 깔끔한 Markdown을 읽고, 구조화된 데이터를 추출하고, 스크린샷을 캡처하고, 브라우저 활동을 검사할 수 있습니다. TRAWL은 빠른 HTTP 요청으로 시작하고, 해결된 브라우저 세션을 재사용하며, 사이트에 더 많은 작업이 필요할 때 Camoufox와 선택적 주거용 프록시로 에스컬레이션합니다. 지원되는 JavaScript 챌린지와...

CVE-2016-3113

CVE-2016-3113 PoC Доказательство концепции для эксплуатации отраженной XSS-уязвимости в веб-интерфейсе oVirt RedHat. В этой PoC виртуальная машина в среде IaaS oVirt запускается через сессию браузера жертвы. Код JS намеренно упрощен из-за спешки. Дополнительная информация:...

EUVD-2026-89476

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-71189

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-100576: Server-Side Request Forgery (SSRF)

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-94372: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

PT-2026-93846

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.4 Description Stored cross-site scripting occurs because the software fails to validate the uTimezone value during write operations and renders it without output encoding on the Dashboard user management page...