ChromeKatz

ChromeKatz ChromeKatz is a solution for dumping sensitive information from memory of Chromium based browsers. As for now, ChromeKatz consists of three projects: 1. CookieKatz - The cookie dumper 2. CredentialKatz - Deprecated.. for now 3. ElevationKatz - Get the decryption key from the elevation...

CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 is a reflected XSS vulnerability in YesWiki's Bazar widget handler. The query parameter in the NoSuchPage/widget endpoint is inadequately sanitized using striptags, which does not escape double quotes. This allows an attacker to break out of HTML attribut...

CVE-2023-31853

CVE-2023-31853 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/bandwidth has reflected XSS via the icon parameter. The methods of exploitation would involve sending a specially crafted request to the victim tha...

nanodump

NanoDump A flexible tool that creates a minidump of the LSASS process. Table of contents 1. Usage 2. Features 3. Combining Techniques 4. Examples 5. HTTPS Redirectors 1. Usage usage: Z:\nanodump.x64.exe --write C:\Windows\Temp\doc.docx --valid --duplicate --elevate-handle --duplicate-elevate...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

CVE-2023-34838

CVE-2023-34838 — eScan Management Console Stored XSS Overview Microworld Technologies eScan Management Console version 14.0.1400.2281 is vulnerable to a Stored Cross-Site Scripting XSS attack. An authenticated attacker with access to the role management feature can inject a malicious script into...

poisontap

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers Created by @SamyKamkar || https://samy.pl When PoisonTap Raspberry Pi Zero & Node.js is plugged into a locked/password protected computer, it: emulates an Ethernet device over USB or Thunderbolt...

uxss-poc

Universal Cross Site Scripting PoC This is a PoC for CVE-2015-0072 for sequentialy get the targeted websites cookies. Disclaimer This Proof of Concept is for educational purpose only. Please do not use it against any system without prior permission. You are responsible for yourself for what you d...

CVE-2026-115513 OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle Once a victim clicks this link, evil.com will receive the cookies...

codoforum

CVE-2020-5842 Stored XSS Vulnerability in Codoforum 4.8.3 Listed in: Exploit-db, Cve Mitre and The daily swig While I was searching for a free forum software for our community I found Codoforum. After installing it We Vyshnav Vizz tried a few simple XSS payloads to ensure the security and suddenl...

CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 Assigned: 11-12-2025 Problem Type: CWE-79 Cross-Site Scripting Affected Product: “AI Font Matcher” posted 2025-10-10, nid=18425 Product page: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html...

CVE-2024-4367-POC-PDFJS

CVE 2024 4367: PoC pour l'exploitation de XSS Cross-Site Scripting 1. Displaying an Alert XSS Trigger Another exploitation example consists of injecting a simple alert message to check if the attack works. python poc.py "alert'XSS exploit triggered';" Explanation : This code injects an alert...

CVE-2024-46278-teedy_1.11_account-takeover

【CVE-2024-46278】teedy1.11account-takeover 【Teedy 1.11】account takeover via XSS Detail There is a vulnerability that causes XSS when downloading files. XSS vulnerability could allow a Teedy administrator to rob an account with a few clicks. This vulnerability is marked as CVE-2024-46278:...

CVE-2021-40906

CVE-2021-40906 - Reflected XSS in an unauthenticated zone Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Author: Edgar Augusto Loyola Torres. Attack type: Reflected XSS Solution: Update to Software Revision 1.6.0p26 or later Summary: CheckMK Raw Edition...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2025-5777

Exploit for CVE-2025-5777: Citrix NetScaler Memory Disclosure CitrixBleed 2 T1606 Disclaimer Intented for authorized use only. It is your responsibility to verify authorization before use. I am not responsible for any legal or criminal proceedings filed against you for using this. Description...

CVE-2022-35497

In Trimble's TM4WEB =22.2.0 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint. Specifically, the three cookies used for maintaining sessions are UID, rstring...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...