CVE-2026-113499

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

PasteJacker

PasteJacker The main purpose of the tool is automating PasteJacking/Clipboard poisoning/whatever you name it attack with collecting all the known tricks used in this attack in one place and one automated job as after searching I found there's no tool doing this job the right way 😄 Now because thi...

CVE-2026-115351

A flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets CSS injection through the unvalidated figwidth option in the figure directive. By inserting arbitrary style rules into rendered web pages, the...

Roundcube-CVE-2024-42008-POC

CVE-2024-42008 RoundCube XSS Exploit Overview This repository contains a proof-of-concept exploit for CVE-2024-42008 , a Cross-Site Scripting XSS vulnerability in RoundCube webmail application. This exploit is designed for educational purposes and controlled penetration testing environments like...

CVE-2026-114731

Add a size limit to the CSS proxy content processing...

CVE-2026-114722

Fix CSS scoping bypass in HTML messages using at-rules...

CVE-2026-114728

Fix remote content blocking bypass via CSS escapes in FuncIRI attributes again...

sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

CVE-2026-115351

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CVE-2026-115351

The Mistune markdown parser (versions 3.2.1 before 3.3.0 ) contains a CSS injection vulnerability (CWE-94). The issue stems from the unvalidated figwidth option within the figure directive , allowing attackers who control markdown input to inject arbitrary style declarations. Specifically, an att...

CVE-2026-115351 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

EUVD-2026-108420

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CSS-Keylogging

CSS Keylogger Chrome extension and Express server that exploits keylogging abilities of CSS. To use Setup Chrome extension 1. Download repository git clone https://github.com/maxchehab/CSS-Keylogging 2. Visit chrome://extensions in your browser or open up the Chrome menu by clicking the icon to t...

VUL4J-59

jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...

EUVD-2026-107409

Astro: Arbitrary CSS injection in Astro View Transitions...

SUSE CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

SUSE CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

SUSE CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

CVE-2024-58258

CVE‑2024‑58258 – SugarCRM SSRF & Local File Disclosure About This repository provides a proof‑of‑concept for CVE‑2024‑58258 , a SugarCRM 13.0.4 / 14.0.1 vulnerability where user input is parsed as LESS in the /css/preview API, allowing unauthenticated SSRF or local file access. Affected Versions...