Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 エクスプロイトタイトル: Vehicle Service Management System - ユーザーリストにおける格納型クロスサイトスクリプティング XSS エクスプロイト作成者: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM 参考文献: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Mechanic-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46069 エクスプロイトタイトル: Vehicle Service Management System - 'Mechanic List' Stored Cross Site Scripting XSS エクスプロイト作者: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 中 参考文献: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

jira-ssrf

jira-ssrf CVE-2017-9506 Atlassian OAuth 插件的 IconUriServlet（1.3.0 至 1.9.12 之前的版本，以及 2.0.0 至 2.0.4 之前的版本）允许远程攻击者通过服务器端请求伪造（SSRF）访问内部网络资源的内容和/或执行 XSS 攻击。...

WolfCMS-XSS-POC

WolfCMS-v0.8.3.1 跨站脚本XSS 已分配CVE编号：CVE-2018-6890...

EUVD-2026-90660

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

CVE-2026-7173

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

CVE-2026-7174

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838

Summary IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Detai...

EUVD-2026-90744

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

CVE-2026-7173

The Entradium platform by Crocantickets contains Cross-Site Scripting (XSS) vulnerabilities. A Stored XSS exists in the City parameter of the /events//edit_general endpoint, allowing JavaScript injection that executes on an event's public page when editing events assigned to a promoter. Additiona...

EUVD-2026-90743

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

Cross-Site Scripting (XSS)

org.apache.wicket, wicket-extensions is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to AjaxEditableChoiceLabel and related components writing attacker-influenced renderer or overridden defaultNullLabel values directly into the page markup without HTML escaping, which allows a...

CVE-2026-85679 Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-90429

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

EUVD-2025-209820

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

EUVD-2025-209823

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

TCL-xss-Labs

XSS Lab — 赛博账簿 💸 如果这个项目对你有帮助，可以考虑捐赠10美元支持它发展。链接：https://rzp.io/rzp/zgkC6h5B 一个交互式、自托管的 XSS 训练平台 ，包含 33 个逐步升级的挑战 —— 专为黑客、渗透测试人员和开发者设计，让你从基础到真实世界利用全面掌握跨站脚本攻击。 ⚡ 为攻击者打造 ⚡ 为学习设计 ⚡ 为简洁构建 单 Node.js 服务器 无需数据库 无需构建步骤 完全 Docker 化，一键部署 挑战 33 个逐步升级的 XSS 挑战，从基础反射型到高级真实世界利用。 🟢 简单 | 名称| 描述 ---|---|--- 1| 你好，反射...

Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_70201)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1781194173)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1781194173 advisory. - Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP...