AOSP-ExploitUserDictionary

AOSP-ExploitUserDictionary PoC Exploit for AOSP UserDictionary Content Provider CVE-2018-9375 Security Advisory https://ioactive.com/wp-content/uploads/2018/08/IOActive-Security-Advisory-AOSP-UserDictionaryProvider-v1.0.pdf More Information...

CVE-2024-48652

CVE-2024-48652 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field Steps to Reproduce: 1.Open the URL: http://127.0.0.1/admin/dashboard 2.Log in using admin credentials. 3.Navigate to the "Settings" section...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

paskto

Paskto - Scanner Web Passif Paskto scanne passivement le web en utilisant l'index Internet Common Crawl, soit en téléchargeant les index sur demande, soit en analysant les données de votre système local. Les URL sont ensuite traitées via Nikto et des listes d'URL connues pour identifier du conten...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin versions before 1.10.2 (specifically versions 1.4.4 through 1.10.1) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to validate the URL scheme of a request-supplied value, which is then reflected into a link on an admi...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

WordPress Academy LMS plugin < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure vulnerability

Subscriber+ Arbitrary Lesson Content Disclosure vulnerability discovered by Morato Antoine in WordPress Plugin Academy LMS versions 4.0.0...

ffuf

ffuf - Fuzz Faster U Fool Un fuzzer web rapide écrit en Go. Installation Exemples d'utilisation Découverte de contenu Découverte de vhosts Fuzzing de paramètres Fuzzing de données POST Utilisation d'un mutateur externe Fichiers de configuration Aide Mode interactif Installation Téléchargez un...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...

bluemonday

bluemonday bluemonday는 Go로 구현된 HTML 살균기sanitizer입니다. 빠르고 설정이 매우 자유롭습니다. bluemonday는 신뢰할 수 없는 사용자 생성 콘텐츠를 입력으로 받아, 승인된 HTML 요소 및 속성의 허용 목록allowlist을 기준으로 살균된 HTML을 반환합니다. 따라서 해당 콘텐츠를 웹 페이지에 안전하게 포함할 수 있습니다. 사용자 생성 콘텐츠를 받아들이고 서버가 Go를 사용한다면, 반드시 bluemonday가 필요합니다. 사용자 생성 콘텐츠를 위한 기본...

asdsadsadasdasdsadsad

This repository does not have a README...

uaf-2023-28205

CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability This vulnerability can be exploited through maliciously crafted web content, allowing attackers to execute arbitrary code. Description The code triggers a use-after-free UAF vulnerability by delaying the addition of Map and Date objects,...

PT-2026-107411

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

PT-2026-107756

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

PT-2026-107696

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An issue exists in the Splunk App for Splunk Observability Cloud where the application does not fully...