Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...

CVE-2026-90795

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

CVE-2026-4103 Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-4103

CVE-2026-4103 is a stored cross-site scripting (XSS) vulnerability in WSO2 API Manager's Publisher Portal and Developer Portal , caused by insufficient HTML sanitization that allows untrusted user input to be rendered without proper encoding or neutralization. When affected API documents are view...

CVE-2023-33829-POC

CVE-2023-33829-POC SCM Manager XSS...

CVE-2026-90795 itsourcecode Loan Management System navbar.php cross site scripting

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

CVE-2026-90795

itsourcecode Loan Management System 1.0 contains a cross-site scripting (XSS) vulnerability in navbar.php , triggered by manipulation of the page argument. The attack can be launched remotely over the network with no authentication required , though user interaction is needed to execute the scrip...

CVE-2026-90943

parallax/filament-comments (through 3.0.0 ) contains a stored cross-site scripting vulnerability in comment body rendering. The root cause is unescaped output in the comment display views (comments.blade.php) and policy layer, allowing authenticated panel users to inject malicious scripts into co...

CVE-2025-4123

Grafana CVE-2025-4123 익스플로잇 CVE ID: CVE-2025-4123 심각도: High 영향: Server-Side Request Forgery SSRF, Cross-Site Scripting 영향을 받는 버전: Grafana 11.2, Grafana 11.3, Grafana 11.4, Grafana 11.5, Grafana 11.6, Grafana 12.0 전체 글 Writeup root@kitploit: ❯ sudo python server.py --host http://127.0.0.1 + Using...

Exploite-CVE-2023-30212-Vulnerability

CVE-2023-30212에 취약한 Docker 환경 생성 설명 Docker 환경과 CVE-2023-30212 취약점 악용. CVE-2023-30212는 OURPHP 7.2.0 이하 버전에 영향을 주는 보안 취약점입니다. 이 취약점은 XSS크로스 사이트 스크립팅 공격을 허용합니다. OURPHP sudo apt update sudo apt install docker.io Docker 이미지 및 Docker 컨테이너 구성 현재 디렉터리에 있는 Dockerfile을 기반으로 Docker 이미지를 빌드합니다 docker build -...

CVE-2023-29489

CVE-2023-29489 CpanelのXSS脆弱性を大量スキャン KALI LINUX sudo pip install BeautifulSoup sudo pip install shodan sudo pip install pystyle git clone https://github.com/0-d3y/CVE-2023-29489.git cd CVE-2023-29489 python cve202329489.py TERMUX pkg install BeautifulSoup pkg instaal shodan pkg install pystyle pkg...

CVE-2022-30507-PoC

설명 자바스크립트 코드 실행을 통한 원격 코드 실행RCE - 렌더링 프로세스를 담당하고 Node.js 코드에 접근하는 nodeintegration에 의한 XSSCross-site-scripting 및 렌더링 프로세스 PoC 동영상 참고 https://www.vicarius.io/vsociety/blog/arbitrary-code-execution-in-notable-cve-2022-30507...

CVE-2024-37888

CVE-2024-37888 이 저장소는 제가 발견하고 보고한 CVE-2024-37888의 취약점 세부 정보와 익스플로잇을 문서화합니다. 메트릭스 CWE-79: 웹 페이지 생성 중 입력 부적절한 중립화 '교차 사이트 스크립팅' CVSS: 6.1 MEDIUM 취약점 개요 이 PoCProof of Concept는 제가 최근 Open Link 플러그인에서 발견한 XSS 취약점의 익스플로잇을 보여줍니다. 이 플러그인이 활성화되면 CKEditor 4의 모든 버전에 직접 영향을 미칩니다. 이 결함은 플러그인이 제대로 살균하지 못하는 편집기...

cPanel-CVE-2023-29489

cPanel CVE-2023-29489에 대한 PoC XSS Payload...

CVE-2024-30270-PoC

이 스크립트는 크로스 사이트 스크립팅XSS과 원격 코드 실행RCE을 이용하여 Mailcow 인스턴스의 취약점을 악용하도록 설계되었습니다. 스크립트는 다음을 목표로 합니다: Mailcow 웹 인터페이스에 XSS 페이로드 주입. XSS 페이로드를 사용하여 승인되지 않은 작업 실행. 서버 템플릿을 덮어쓰고 명령을 실행하여 RCE 달성. 요구 사항 1. Python 3: 컴퓨터에 Python 3이 설치되어 있는지 확인하세요. 공식 웹사이트https://www.python.org/downloads/에서 다운로드할 수 있습니다. 2...

Important: Red Hat Security Advisory: delve security update

An update for delve is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-78318

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

EUVD-2026-77439

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys that contain non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each of these characters would be interpreted as the start of a separate attribute. If an...