CVE-2017-9934

CVE-2017-9934 I am the reporter of this exploit, under name: Envo Joomla 1.7.3 - 3.7.2 CSRF exploit PoC This vulnerability works due to Joomla versions 1.7.3 to 3.7.2 not sanitizing base64 input. Headers: root@kitploit: POST...

CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Vista General Este es un PoC de la CVE-2025-22131 , una vulnerabilidad de Cross-Site Scripting XSS en PhpSpreadsheet en versiones anteriores a 2.2.2, 2.1.2 y 1.29.4. La vulnerabilidad reside en la función generateNavigation, que no sanitiza los...

CVE-2026-30691

CVE-2026-30691 - Aviso de Vulnerabilidad Detalles oficiales del registro de vulnerabilidades de MITRE y documentación técnica para CVE-2026-30691. root@kitploit: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Suggested description La vulnerabilidad de Cross-Site Scripting XSS en...

CVE-2022-3464

CVE-2022-3464 Se ha encontrado una vulnerabilidad clasificada como problemática en puppyCMS hasta la versión 5.1. Esto afecta a una parte desconocida del archivo /admin/settings.php. La manipulación del argumento sitename conduce a cross site scripting. Es posible iniciar el ataque de forma remot...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Multi-Stage Exploitation VM 💀 Kalaichelvan Thieveshkar CB013248 · Staffordshire University · COMP50003 - Cyber Security II Overview RootQuest is a purpose-built CTF virtual machine that contains a 10-stage , sequential attack path spanning 5 security domains. Each challenge...

CVE-2024-42834

Título del Exploit: VULNERABILIDAD DE CROSS-SITE SCRIPTING XSS ALMACENADO EN INCOGNITO SAC Fecha: 26 DE JULIO DE 2024 Autor del Exploit: Etienne Supra Página web del proveedor: https://www.incognito.com/products/service-activation-center/ Versión: 14.11 CVE : CVE-2024-42834 Se ha informado al...

CVE-2026-90489

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVEs

CVE List CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md...

PT-2026-90986

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2025-63842

CVE-2025-63842 is a Cross-Site Scripting (XSS) vulnerability in the web backend of the Repetico app 1.9.7.31 for Android . A remote authenticated user can execute arbitrary JavaScript in the app's context by supplying crafted input in the multiple-choice question text field . The CVSS 3.1 score i...

PT-2026-90865

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Prueba de ConceptoPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md Prueba de ConceptoPoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CVE-2024-33210

CVE-2024-33210 Se ha identificado una vulnerabilidad de secuencia de comandos entre sitios XSS en Flatpress 1.3. Esta vulnerabilidad permite a un atacante inyectar scripts maliciosos en páginas web vistas por otros usuarios. Tipo de Vulnerabilidad: Secuencia de Comandos entre Sitios XSS Vendor de...

CVE-2024-24136

CVE-2024-24136 : Juego de Matemáticas Cross-Site-Scripting Prueba de ConceptoPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24136.md Prueba de ConceptoPoC : https://github.com/BurakSevben/CVE-2024-24136/blob/main/CVE-2024-24136.md...

CVE-2024-40511

CVE-2024-40511 Vulnerabilidad de Cross Site Scripting en openPetra v.2023.02 a través de la función serverMServerAdmin.asmx. Descripción : Un usuario no autenticado puede robar cookies de un usuario autenticado explotando un XSS en openPetra v.2023.02 a través de la función serverMServerAdmin.asm...

CVE-2024-48591

CVE-2024-48591 Divulgación de Vulnerabilidad: XSS en Inflectra SpiraTeam 7.2.00 Descripción La versión 7.2.00 de Inflectra SpiraTeam es vulnerable a Cross-Site Scripting XSS a través de la carga de archivos SVG especialmente diseñados, que pueden ejecutar JavaScript cuando se ven directamente. Ti...

CVE-2022-38553

CVE-2022-38553 CROSS SITE SCRIPTING XSS EN "ACADEMY LEARNING MANAGEMENT SYSTEM" VIDEO POC:...

CVE-2024-25202

CVE-2024-25202 Se encontró una vulnerabilidad en PHPgurukul visitor management system 1.0. Ha sido clasificada como problemática. El problema afecta una funcionalidad desconocida de la barra de búsqueda que llama a search-result.php y search-visitor.php. La vulnerabilidad es Cross-Site-Scripting...