CSPBypass

CSP Bypass Bienvenido a CSPBypass.com , una herramienta diseñada para ayudar a los hackers éticos a eludir Políticas de Seguridad de Contenido CSP restrictivas y explotar vulnerabilidades XSS Cross-Site Scripting en sitios donde las inyecciones están bloqueadas por CSP que solo permiten ciertos...

EUVD-2025-26672

Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...

cspparse

cspparse 描述 cspparse 是一个用于评估内容安全策略（Content Security Policies）的工具。它利用 Google 的 API 获取 CSP 头，并以 ReconJSON 格式返回。它不仅通过 Google 的 API 检查头信息，还会解析目标站点的 HTML，查找 标签中指定的任何 CSP 规则。 安装 安装命令并通过 Go Get 下载源码 cspparse 命令将被安装到 $GOPATH/bin，源码（来自 https://github.com/lc/cspparse）将位于...

browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

JSONBee

JSONBee 一个随时可用的 JSONP 端点集合，帮助绕过不同网站的内容安全策略。 该工具在 2018 年基辅的 HackIT 大会上展示。演示文稿可在此处查看（不确定为什么幻灯片格式乱了 :D）：https://www.slideshare.net/HackenEcosystem/ebrahem-hegazy-bug-hunters-manual-for-bypassing-contentsecuritypolicy 什么是 JSONBee？ 该工具的主要思想是自动找到能帮助绕过目标网站内容安全策略的 JSONP 端点。JSONBee 接收一个 URL 名称（例如...

CVE-2026-91122

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2020-6519

This was originally published on PerimeterX company's official Github through my work Github account. Eventhough this is my work - all rights and legal concerns belong to PerimeterX company. Chromium 83 Zero Day Full CSP Bypass Cross Platforms CVE-2020-6519 Exploit DB Technical Article as to the...

CVE-2020-6519

Chromium 83 Día Cero Bypass Completo de CSP Multiplataforma CVE-2020-6519 Artículo técnico POC tal como fue reportado al proyecto Chromium...

CVE-2026-77912 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-54477

CVE-2026-54477: Panel de administración sin cabeceras de seguridad clickjacking / XSS Aviso Campo| Valor ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medio Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

zappzarapp-php-security

⚡ zappzarapp/security Biblioteca integral de seguridad para PHP que proporciona CSP, cabeceras de seguridad, protección CSRF, cookies seguras, validación de contraseñas, saneamiento de entradas, limitación de velocidad, SRI, carga de secretos, cifrado, seguridad de sesiones, autenticación de dos...

OESA-2026-3955 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: The nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a...

CVE-2026-55630

Kiwi TCMS versions prior to 16.1 are vulnerable to stored XSS through the TestCase.extra_link and TestPlan.extra_link fields, which accepted unsanitized user input and rendered it verbatim, allowing injection of a javascript: URI. In default deployments using official Docker images or unmodified ...

EUVD-2026-78674

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...

CVE-2026-55630: Improper Neutralization of Input During Web Page Generation

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...

ROS-20260915-73-0094

The vulnerability of the Content Security Policy component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability allows an attacker to compromise data integrity through a specially crafted HTML page...

Astra Linux – Vulnerability in Firefox, Thunderbird

As specified in the W3C Content Security Policy draft, when creating a violation report, “User agents need to ensure that the source file is the URL requested by the page, with pre-redirecting. If this is not possible, user agents must strip the URL to its origin to prevent unintentional leakage....

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Content Security Policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy through a malicious Chrome Extension...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the content security policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...