CVE-2025-4664

🔒 Vulnerabilidad CVE-2025-4664 La vulnerabilidad CVE-2025-4664 es un fallo de seguridad de alta gravedad identificado en el componente Loader de Google Chrome, presente en versiones anteriores a la 136.0.7103.113. Este problema permite a un atacante remoto filtrar datos de origen cruzado mediante...

cve-2020-16012

Este repositorio contiene PoCs para CVE-2020-16012, una vulnerabilidad de canal lateral en la implementación de CanvasRenderingContext2D.drawImage en Firefox y Chromium. Lee un informe de esta vulnerabilidad en el blog de Mozilla Attack & Defense. Dentro de benchmark hay código para medir el tiem...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2023-45857-Demo

Demostración para verificar el comportamiento de la vulnerabilidad CVE-2023-45857 de axios 1. Iniciar con dev container 2. Ejecutar npm run dev en el contenedor app 3. Acceder a http://app.localhost 4. Verificar que la Cookie XSRF-TOKEN esté configurada en las herramientas de desarrollador del...

CVE-2026-103629

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-103621

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-91712

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-91708

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

theftfuzzer

┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introducción: TheftFuzzer es una herramienta que fuzzea implementaciones de Intercambio de Recursos de Origen Cruzado en busca de configuraciones incorrectas comunes. Uso: python theftfuzzer.py -d...

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Aviso de seguridad | Payloads incluidos | Preguntas frecuentes DESCARGO DE RESPONSABILIDAD: Este software es solo con fines educativos. Este software no debe utilizarse para actividades ilegales. El autor no es responsable de su uso. No seas un imbécil. DNS Rebind Toolki...

CVE-2015-5119

CVE-2015-5119 Un exploit tipo COOP...

CVE-2026-100182

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

PT-2026-104117

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-34200

Servidor MCP de Nhost: Compromiso de Infraestructura con un Solo Clic Aviso oficial: Esta vulnerabilidad fue reconocida y publicada por Nhost: GHSA-6c5x-3h35-vvw2 Este repositorio documenta una vulnerabilidad en el Servidor MCP Local de Nhost. El servicio carece de autenticación de entrada e...

CVE-2026-27579-CollabPlatform-Appwrite-CORS-Misconfiguration

PoC de Explotación de Mala Configuración CORS en Appwrite CVE-2026-27579 – Fuga de Datos de Cuenta Autenticada mediante CORS Permisivo CVE-2026-27579 GHSA-qh5m-p8jh-hx88 Una mala configuración grave de CORS en el backend de Appwrite utilizado por realtime-collaboration-platform permite que un...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-32913

Al revisar el código fuente, me centré en cómo OpenClaw maneja las solicitudes HTTP, específicamente en la función fetchWithSsrFGuard, responsable de realizar llamadas fetch del lado del servidor. Noté algo extraño. Cuando una solicitud seguía una redirección de origen cruzado lo que significa qu...

CVE-2026-2828-WebGPU-Cross-Origin-Pixel-Stealing-via-Timing

4. CVE-2026-2828 – WebGPU Cross‑Origin Pixel Stealing via Timing Overview A malicious website uses WebGPU compute shader timing to measure rendering time of a cross‑origin iframe, recovering pixel values of sensitive content e.g., banking details. Severity: High Information Disclosure...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...