hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install root@kitploit: $ pip install hsecscan Usage root@kitploit: $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D...

CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-

Obiettivo:http://117.72.165.13:8888/ Github:https://github.com/201206030/novel Versione:V3.5.0 Nome della vulnerabilità:Vulnerabilità di Cross-Site Scripting XSS basata su DOM in novel V3.5.0 CWE-79 Tipo di vulnerabilità: Cross-Site Scripting basato su DOM DOM-based XSS Data di scoperta: 2025-11-...

CVE-2025-29471

Nagios Log Server में स्टोर्ड XSS भेद्यता व्यवस्थापक के लिए विशेषाधिकार वृद्धि ▶️ PoC प्रदर्शन तिथि: 2025-04-02 शोषण लेखक: सेठ क्राफ्ट विक्रेता होमपेज: https://www.nagios.com/ विक्रेता परिवर्तन सूची: https://www.nagios.com/changelog/log-server सॉफ्टवेयर लिंक:...

CVE-2026-39275

CVE-2026-39275 - XSS stocké menant à la prise de contrôle de compte dans Cockpit CMS Note: Divulgué de manière responsable et corrigé par les mainteneurs de Cockpit CMS avant publication...

CVE-2025-12163

CVE-2025-12163: Omnipress WordPress प्लगइन में स्टोर्ड क्रॉस-साइट स्क्रिप्टिंग विषय सूची अवलोकन भेद्यता विवरण तकनीकी विश्लेषण हमला वेक्टर निवारण मार्गदर्शिका CVSS मीट्रिक्स संदर्भ...

CVE-2026-76316

An unauthenticated remote attacker who can reach the Splunk management port can register a crafted Deployment Server client identifier, which is then inserted into dispatched searches without special-character sanitization. When an administrator opens the Add Data forwarder workflow, the injected...

Exploit for CVE-2026-64638

xss2shell-check Non-destructive, dependency-free detector for...

Exploit for CVE-2026-12345

CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...

GO-2024-3038 vulnerabilities

Vulnerabilities for packages: guac...

GO-2023-2413 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, apm-server, cloudbeat-fips, apm-server-fips, cloudbeat, elastic-agent...

CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-19716

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716

CVE-2026-19716 affects maalfer Pentestify prior to 1.1.1 in the user management component. A stored XSS (CWE-79) vulnerability arises when the frontend escapes the username with escapeHTML() before inserting it into the onclick handler of the account deletion button; because HTML decodes attribut...

EUVD-2026-57930

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

PT-2026-76573

Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0 Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the...

PT-2026-71494

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

Security Bulletin:Vulnerability in Spring MVC affects IBM Netezza Appliance

Summary The Spring MVC package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41846 Vulnerability Details CVEID:CVE-2026-41846 DESCRIPTION: Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle...