CVE-2024-25411

CVE-2024-25411 Una vulnerabilità di cross-site scripting XSS in Flatpress v1.3 consente agli attaccanti di eseguire script web arbitrari o HTML tramite un payload appositamente creato iniettato nel parametro username in setup.php Tipo di vulnerabilità : Cross Site Scripting XSS Vendor del prodott...

TCL-xss-Labs

XSS Lab — The Cyber Ledger 💸 Se questo progetto ti aiuta, considera di supportarlo con una donazione di $10 per farlo crescere. Link: https://rzp.io/rzp/zgkC6h5B Una piattaforma interattiva e auto-ospitata per l'addestramento su XSS con 33 sfide progressivamente più difficili — progettata per...

Bludit-3.13.1-About-Plugin-Stored-Cross-Site-Scripting-XSS

CVE-2021-45745 Exploit Title: Bludit 3.13.1 - About Plugin Stored Cross Site Scripting XSS Autore Exploit: SANU P.L CVE: CVE-2021-45745 CVSS: 5.4 MEDIUM Riferimenti: https://www.plsanu.com/bludit-3-13-1-about-plugin-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-45745...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

xss_vulnerability_challenges

Scenari di vulnerabilità XSS sfide Questo repository è una applicazione PHP dockerizzata contenente alcune sfide di vulnerabilità XSS. Le idee alla base delle sfide sono: Bypass della validazione Javascript Bypass delle entità HTML Bypass WAF Bypass della validazione della black-list Bypass della...

SuiteCRM-RCE

CVE-2020-28328 SuiteCRM Esecuzione di codice remoto tramite impostazione di sistema del file di log e avvelenamento del file di log Panoramica Recentemente ho scoperto due vulnerabilità in SuiteCRM che forniscono una catena di attacco per un utente con privilegi limitati per ottenere l'esecuzione...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can...

BIT-KEYCLOAK-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious client with a...

CVE-2026-16231

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2025-56515

CVE-2025-56515 Cross-Site Scripting XSS Schwachstelle in der Fiora Chat-Anwendung CVE-2025-56515: Cross-Site Scripting XSS Schwachstelle in der Fiora Chat-Anwendung Schwachstellenübersicht CVE-ID : CVE-2025-56515 Schwachstellentyp : Cross-Site Scripting XSS Angriffsart : Remote Auswirkung :...

Exploite-CVE-2023-30212-Vulnerability

Crea un ambiente Docker vulnerabile suscettibile a CVE-2023-30212 Descrizione L'ambiente Docker e lo sfruttamento della vulnerabilità CVE-2023-30212. CVE-2023-30212 è una vulnerabilità di sicurezza che interessa le versioni di OURPHP precedenti o uguali alla 7.2.0. Questa vulnerabilità consente...

-create-a-vulnerable-Docker-environment-that-is-susceptible-to-CVE-2023-30212

crea un ambiente Docker vulnerabile suscettibile a CVE 2023-30212 Descrizione Ambiente Docker ed exploit della vulnerabilità CVE-2023-30212. VE-2023-30212 è una vulnerabilità di sicurezza che colpisce le versioni di OURPHP precedenti o uguali alla 7.2.0. Questa vulnerabilità consente attacchi di...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization

A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and...

CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

CVE-2024-4367-PoC

CVE-2024-4367-PoC Questa Proof of Concept PoC dimostra lo sfruttamento della vulnerabilità CVE-2024-4367, che coinvolge attacchi di Cross-Site Scripting XSS. Caratteristiche Questa PoC raccoglie e visualizza i seguenti tipi di informazioni: 1. Informazioni Generali: Dominio Titolo URL corrente UR...

CVE-2024-39248

Titolo Exploit: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Autore Exploit: Jason Jacobs 0xjasonjacobs - Twitter Homepage del fornitore: https://sourceforge.net/projects/simpcms/ Endpoint vulnerabile: /SimpCMS/admin.php Una vulnerabilità di cross-site scripting XSS in SimpCMS v0.1...

WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lanlv - HPT Vietnam Coporation in WordPress Plugin WP w3all phpBB versions = 3.0.6...