EUVD-2026-86325

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

EUVD-2026-86321

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-97233

A cross-site scripting (XSS) vulnerability exists in volotat Anagnorisis (versions up to 0.4.11 ). The flaw is located in the html function of the PlaylistManager.js file within the Media Filename Handler component. Attackers can achieve XSS by manipulating the file_path argument. This vulnerabil...

CVE-2021-41349

Microsoft Exchange Exploit CVE-2021-41349 Exploiting: CVE-2021-41349 This exploiting tool creates a Form for posting XSS Payload to the target Exchange server. You need to create a js containing your desire to do. Usage 1. Create Your js Payload and upload it somewhare. 2. run the CVE-2021-41349....

CVE-2021-45416

Docker RosarioSIS Instalación Requisitos mínimos: Docker y Git funcionando. Puedes extraer la imagen de DockerHub o: 1. docker on $ git clone https://github.com/dnr6419/CVE-2021-45416.git $ cd CVE-2021-45416 $ docker-compose up -d 2. Visita la URL e instala la base de datos...

CVE-2026-22610

Escáner de Vulnerabilidades SVG en Angular CVE-2026-22610 Propósito: Escanea proyectos Angular en busca de posibles vulnerabilidades XSS en elementos SVG Uso Ejecute el script desde la raíz del proyecto: Escanear la carpeta actual node scan-angular-svg-vuln-final.js Escanear una carpeta específic...

CVE-disclosures

CVE-2026-3171 y CVE-2026-3170 – Archana M Divulgaciones oficiales de vulnerabilidades por Archana M. 🔹 CVE-2026-3171 Producto: SourceCodester / Patrick Mvuma Patients Waiting Area Queue Management System 1.0 Tipo de vulnerabilidad: Cross-Site Scripting CWE-79 Archivo afectado: /queue.php Vector d...

CVE-2026-10289-XSS

Hotel and Tourism Reservation System - Stored Cross-Site Scripting XSS Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - Stored Cross-Site Scripting XSS CVE ID| Pending Assignment Vendor| code-projects.org Vendor URL|...

CVE-2023-48858

CVE-2023-48858 PoC for CVE-2023-48858 A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part. Proof of Concept:...

CVE-2024-56289

CVE-2024-56289 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Vulnerable version Since this plugin uses the REST API, the Permalink must be set to Post name. 2. Subsequently, accessing...

CVE-2024-50803-Redaxo

CVE-2024-50803 Stored XSS in mediapool feature of Redaxo A stored cross-site scripting XSS vulnerability was found in Redaxo versions 5.18.0, allowing attackers with sufficient privileges to upload a malicious SVG file through the mediapool feature. Published a write-up :...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - Cross-Site Scripting Craft CMS 3.0.25 - Vulnerabilidad de Cross-Site Scripting CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 Prueba de concepto Permite ejecutar un Cross-Site Scripting al guardar un nuevo título desde la pestaña de la consola. POST...

Bolt-CMS-3.6.2---Cross-Site-Scripting

Bolt CMS 3.6.2 - Cross-Site Scripting Vulnerability Bolt CMS 3.6.2 - Cross-Site Scripting Vulnerability CVE-2018-19933 https://vulners.com/cve/CVE-2018-19933 Proof of Concept To exploit vulnerability, Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - Cadena de herramientas de exploit XSS CSRF RCE PacketStorm WLB-2020080010 Descargo de responsabilidad: esta cadena de herramientas de exploit fue inspirada por EDB-ID 20009. Objetivo El objetivo de esta cadena de herramientas de exploit es reemplazar EDB-ID...

CentOS-Control-Web-Panel-CVE

CentOS Control Web Panel version 0.9.8.836 - 0.9.8.847 On June 29, 2019 our team started to find vulnerability on CentOS Control Web Panel CWP version 0.9.8.836, and we found some critical vulnerabilites. Some of the vulnerabilities we found can be chained to compromise the server from anonymous...

svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...

CVE-2026-97224

A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. Th...

osticket-stored-xss-security-assessment

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip Consultant-Style Cybersecurity Report Professional vulnerability assessment report for osTicket stored cross-site scripting, including business impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|--- Report...

Trickster-HTB

Informe de Explotación de Trickster Acerca de Trickster Trickster es una máquina Linux de dificultad media que presenta múltiples vulnerabilidades en diferentes servicios. Este informe describe el proceso de explotación de estas vulnerabilidades para lograr un compromiso completo del sistema. Pas...

CVE-2022-29380

CVE-2022-29380 CVE-2022-29380 Fecha: 25/05/2022 Autor: OpenXP Team Software: Academy LMS Versión: Academy LMS = v4.3 Tipo: Cross-Site Scripting OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Neutralización incorrecta de la entrada durante la generación de páginas web 'Cross-site Scripting'...