53535 matches found
CVE-2026-109936 Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allow...
flash-exploit-defense-system
flash-exploit-defense-system Comprehensive multi-layer defense system against Adobe Flash CVE exploits CVE-2012-0754, CVE-2015-xxxx, CVE-2016-xxxx, CVE-2018-xxxx with browser, mobile, server, and system-level protection...
CVE-2024-57484
CVE-2024-57484 Directory listing vulnerability was found in the FoxyProxy extension. This issue allows unauthorized users to view the structure and content of the extension internal files including log.js,commands.js,schema.json,authentication.js and location.js along with their last-modified...
the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss
CVE-2026-78997 — UC Browser for Android Universal XSS UXSS PoC material for CVE-2026-78997 — Universal Cross-Site Scripting in UC Browser for Android com.UCMobile.intl, version 13.7.8.1314, disclosed by Omri Inbar Novee. A reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn grants access t...
ReelPhish
Instructions for ReelPhish: This tool has been released along with a FireEye blog post. The blog post can be found at the following link: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html Installation Steps 1. The latest release of Python 2.7.x...
CVE-2012-1723
Web browser drive-by that exploits CVE-2012-1723 for remote code execution. A walk-through and technical details can be found at https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...
authcov
AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...
Digital-Privacy
English | 简体中文 There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. Bruce Schneier《Applied Cryptography》 Content : Information Protection, Open-source...
Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...
D-Link Central WifiManager - Server-Side Request Forgery
D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an...
cve-2026-40369-exploit
This references https://voidsec.com/cve-2026-40369-browser-sandbox-escape/, the approach differs significantly from https://github.com/orinimron123/CVE-2026-40369-EXPLOIT, and since I didn't see any public exp from them, I documented it...
CVE-2019-6447
CVE-2019-6447 The above investigation of the ES file browser security weakness allows us to see the issue in its entirety...
CVE-2024-6473-PoC
CVE-2024-6473 PoC Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. Vulnerable browser version !IMPORTANT The Internet must be turned off during installation, otherwise the browser will be updated. You can download vulerable...
user-agent-desktop
This project is discontinued. We recommend to use Ghostery Tracker and Ad Blocker in Firefox. Ghostery Private Browser The Ghostery Desktop Browser is a minimal fork of Firefox optimised for privacy. The main extra features are: The Ghostery Privacy Blocker extension is included and enabled by...
PT-2026-121776
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...
PT-2026-122145
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...
two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal
CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...
osintnet-public
OsintNET is a browser-based OSINT platform for domain intelligence, website risk scanning, SERP discovery, email and username OSINT, image intelligence, image authenticity checks and AI image detection. Website · OSINT Tools · Best OSINT Tools · AI OSINT Tools · llms.txt · AI Prompt Map OsintNET ...
SyncShield
🔐 SyncShield — Browser Extension for CVE-2018-5764 Detection Detect unsafe Rsync commands before they become exploits A lightweight, privacy-focused browser extension developed as part of Final Year Project NWS/129/23B to detect missing --protect-args flag in Rsync commands — preventing remote...