6249 matches found
zappzarapp-php-security
⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...
CVE-2020-6519
This was originally published on PerimeterX company's official Github through my work Github account. Eventhough this is my work - all rights and legal concerns belong to PerimeterX company. Chromium 83 Zero Day Full CSP Bypass Cross Platforms CVE-2020-6519 Exploit DB Technical Article POC as...
CSPBypass
CSP Bypass Welcome to CSPBypass.com , a tool designed to help ethical hackers bypass restrictive Content Security Policies CSP and exploit XSS Cross-Site Scripting vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains. Website Visit CSPBypass.co...
JoySafety
JoySafety — Large Model Security Framework 📋 Table of Contents Project Introduction ✨ Features 🚀 Quick Start 📖 User Guide 🏆 Best Practices 🏗️ Architecture Design 🛠️ Development 📄 License 📅 Roadmap Star History new release ✅ Prompt injection detection model fully upgraded : Training system...
JSONBee
JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...
CVE-2020-6519
Chromium 83 Zero Day Full CSP Bypass Cross Platforms CVE-2020-6519 Technical Article POC as reported to the chromium project DEMO Vids!...
cspparse
cspparse Description cspparse is a tool to evaluate Content Security Policies. It uses Google's API to retrieve the CSP Headers and returns them in ReconJSON format. Not only does it check for headers with Google's API, it also parses the target site's HTML to look for any CSP rules that are...
CVE-2026-54477
CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...
browsertunnel
browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...
CVE-2026-67444
Hubleys , a dashboard for self-hosted services, is vulnerable to Stored XSS prior to version 0.5.2 . An authenticated non-admin user can upload a file with an arbitrary extension as a dashboard "background image." The server serves this file back with a Content-Type derived directly from the atta...
IBM WebSphere eXtreme Scale 8.6.1.0 <= 8.6.2.2 Multiple Vulnerabilities (7293764)
The version of IBM WebSphere eXtreme Scale installed on the remote host is 8.6.1.0 through 8.6.2.2. Its Liberty deployment is, therefore, affected by multiple vulnerabilities as referenced in the 7293764 advisory. - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker...
IBM WebSphere eXtreme Scale 8.6.1.0 < 8.6.2.2 XSS (7293764)
The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.2.2 IBM. It is, therefore, affected by multiple vulnerabilities as referenced in the 7293764 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements fro...
CVE-2026-125110
A flaw was found in Rack. An unauthenticated remote attacker can bypass path-specific security headers by requesting files using paths containing raw or percent-encoded dot segments. This issue occurs because the static file serving component normalizes paths when locating files but evaluates...
CVE-2026-125729
Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...
EUVD-2026-121395
Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...
CVE-2026-125729 Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it
Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...
CVE-2026-125729
Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...
CVE-2026-125729
The Plack::Middleware::CSP library for Perl (versions before 0.03 ) is vulnerable to a configuration error where the call method sets the Content Security Policy under the incorrect header name "content-security-protocol" instead of "Content-Security-Policy" . Because browsers ignore the incorrec...
PT-2026-141871
Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...