CSPBypass

CSP Bypass Bienvenido a CSPBypass.com , una herramienta diseñada para ayudar a los hackers éticos a eludir Políticas de Seguridad de Contenido CSP restrictivas y explotar vulnerabilidades XSS Cross-Site Scripting en sitios donde las inyecciones están bloqueadas por CSP que solo permiten ciertos...

CVE-2020-6519

Esto fue publicado originalmente en el Github oficial de la empresa PerimeterX a través de mi cuenta de Github de trabajo. Aunque este es mi trabajo - todos los derechos y asuntos legales pertenecen a la empresa PerimeterX. Chromium 83 Zero Day: Bypass Completo de CSP Multiplataforma CVE-2020-651...

CVE-2019-18426

Esto fue publicado originalmente en el Github oficial de la empresa PerimeterX a través de mi cuenta de Github de trabajo. Aunque este es mi trabajo, todos los derechos y asuntos legales pertenecen a la empresa PerimeterX. Divulgación de vulnerabilidades de WhatsApp - Open Redirect + Bypass de CS...

CVE-2020-6519

Chromium 83 Día Cero Bypass Completo de CSP Multiplataforma CVE-2020-6519 Artículo técnico POC tal como fue reportado al proyecto Chromium...

pixload

pixload -- Image Payload Creating tools DESCRIPTION Set of tools for hiding backdoors creating/injecting payload into images. The following image types are currently supported: BMP, GIF, JPG, PNG, WebP. about Useful references for better understanding of pixload and its use-cases: Bypassing CSP...

JSONBee

JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads root@kitploit: ... -- root@kitploit: root@kitploit: root@kitploit: root@kitploit: root@kitploit: root@kitploit: root@kitploit:...

POC-CVE-2025-29927

CVE-2025-29927: PoC de Bypass de Middleware de Next.js Descripción general Este PoC demuestra CVE-2025-29927, una vulnerabilidad en el middleware de Next.js que permite a los atacantes eludir los mecanismos de autenticación, autorización y CSP mediante el encabezado x-middleware-subrequest...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Next.js Middleware Bypass Vulnerability This repository demonstrates the CVE-2025-29927 vulnerability in Next.js where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions root@kitploit: Next.js...

loxs-optimized

loxs-optimized Proyecto de https://github.com/coffinxp/loxs CSP-Bypass-xss.txt Nota: Principalmente elude el payload de CSP 2024-11-06 Añade CSP-Bypass-xss.txt a xss.txt 2024-11-07 Eliminando información que interfiere Solo se muestra la información vulnerable 2024-11-11 Resuelve el problema de q...

nextjs-middleware-exploit

Investigación de vulnerabilidad en middleware de Next.js CVE-2025-29927 Este repositorio demuestra una vulnerabilidad crítica en el middleware de Next.js CVE-2025-29927, que afecta a las versiones 11.1.4 hasta 15.1.7. Esta vulnerabilidad permite el bypass de autorización , el bypass de CSP y...

next.js_cve-2025-29927

next.jscve-2025-29927 A small and simple Next.js application running version 14.2.24 used to test CVE-2025-29927. Access the admin area /admin by utilizing the vulnerability or the hardcoded credentials admin:admin. root@kitploit: » git clone...

CVE-2019-18426

WhatsApp漏洞披露 - 开放重定向 + CSP绕过 + 持久性XSS + 文件系统读取权限 + 潜在远程代码执行 CVE-2019-18426 技术文章 原始漏洞披露文档 演示视频！...

Astra Linux – Vulnerability in Firefox

Because Firefox did not implement the unsafe-hashes CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy might have been able to inject executable scripts. This would be severely restricted by the specified Content Security Policy o...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in Action Pack versions = 5.2.0 and 5.2.0, which could allow an attacker to bypass the Content Security Policy and generate non-HTML responses...

Astra Linux – Vulnerability in Firefox and Thunderbird

The XSLT document loading failed to properly propagate the source document, which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Summary Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces ...

CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

EUVD-2026-68328

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...