CVE-2026-47665

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2021-42697

Akka HTTP 10.1.x anterior a 10.1.15 e 10.2.x anterior a 10.2.7 podem encontrar exaustão de pilha ao analisar cabeçalhos HTTP, o que permite que um atacante remoto realize um ataque de Negação de Serviço ao enviar um cabeçalho User-Agent com comentários profundamente aninhados. Referências MITRE...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. semplice xss : 2. semplice csrf: codice del sito web dell'attaccante--- https://github.com/kuangting4231/wordpress.github.io 3. csrf esecuzione remota di codice: codice del sito web dell'attaccante--- https://github.com/kuangting4231/assigment1.github.io mitigazion...

CVE-2023-47437

CVE-2023-47437 Pachno Schwachstelle für gespeichertes Cross-Site-Scripting https://vulners.com/cve/CVE-2023-47437 Beschreibung: In Pachno wurde eine Schwachstelle identifiziert, die es einem authentifizierten Angreifer ermöglicht, einen Angriff mit gespeichertem Cross-Site-Scripting XSS...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE Este repositório contém uma Prova de Conceito PoC para a vulnerabilidade CVE-2025-62222. Demonstra como é possível alcançar a Execução Remota de Código RCE na máquina de um desenvolvedor manipulando o contexto do GitHub Copilot Chat no VS Code por mei...

YT-Spammer-Purge

YouTube Spammer Purge Cos'è? - Consente di filtrare e cercare commenti spam sul tuo canale e su canali altrui in molti modi diversi E cancellarli/segnalarli tutti insieme vedi funzionalità sotto. Come scaricare: Clicca sul collegamento "Releases" a destra, poi sulla release più recente, sotto...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Lettura arbitraria di file da parte di utenti autenticati Autore+ tramite Directory Traversal Descrizione Il plugin WordPress Comments Import & Export per WordPress è vulnerabile alla lettura arbitraria di file a causa di una validazione...

CVE-2021-44217

CVE-2021-44217 Descrizione suggerita In Ericsson CodeChecker fino alla versione 6.18.0, una vulnerabilità di Cross-site scripting XSS persistente nel componente dei commenti del visualizzatore di report consente ad attaccanti remoti di iniettare script web o HTML arbitrari tramite i dati JSON POS...

CVE-2024-3640_WafBypass

CVE-2024-3640 WafBypass exploit del plugin woodpacker Il metodo di bypass consiste essenzialmente nell'inserire commenti XML per eludere le parole chiave. Rilevamento del ritardo Esecuzione comando con riscontro Memory shell personalizzato...

wordlist_generator

wordlistgenerator Das Tool wordlistgenerator generiert eine für Ihr Ziel einzigartige Wortliste mit Techniken, die in tomnomnoms Video "Who, What, Where, When" erwähnt werden. Es verwendet URLs von gau, um Verzeichnisse, Dateinamen oder Wörter auf Seiten zu extrahieren. Als zusätzliche Funktion...

Show all comments < 7.0.1 - Cross-Site Scripting

The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. id: CVE-2022-4295 info: name: Show all commen...

ccs

Code-Anmeldedaten-Scanner Dieses Skript soll eine große, vielfältige Codebasis nach fest codierten Anmeldedaten oder in Konfigurationsdateien vorhandenen Anmeldedaten durchsuchen. Diese stellen ein ernstes Sicherheitsproblem dar und sind äußerst schwer zu erkennen und zu verwalten. Der spezifisch...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340

A Broken Access Control vulnerability in ThingsBoard Professional Edition (PE) 4.21 and below affects the Alarms comments functionality. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments , enabling impersonation of system mess...

POC-CVE-2023-3244

Prova di concetto per CVE-2023-3244 Ciao, questa è una semplice Prova di Concetto PoC per la vulnerabilità CVE-2023-3244 trovata nel plugin WordPress "comments-like-dislike". La vulnerabilità interessa le versioni del plugin fino alla 1.2.0 inclusa. Per sfruttare questa vulnerabilità, puoi fare...

drinkme

drinkme drinkme is a shellcode test harness. It reads shellcode from stdin and executes it. This allows pentesters to quickly test their payloads before deployment. Formats drinkme can handle shellcode in the following formats: "0x" "\x" "x" "" For example, NOP could be represented as any of...

hardcodes

hardcodes extract strings from source code...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

vbsmin

VBSmin VBScript minifier Features ⬜️ Remove extra whitespace Trailing whitespace Leading whitespace Blank lines Inline extra spaces 💬 Remove comments Single quote start of the line Single quote inline REM 1️⃣ One-line Line splitting underscore Colon Quick start Quick install root@kitploit: $ gem...

CVE-2026-38472

GazellePW (GazellePosterWall) contains a Stored XSS vulnerability in its forum reward comments feature, identified at commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote attackers can inject arbitrary JavaScript through the c parameter in /forums.php?action=ajax_get_jf. The injected payload ...