590 matches found
CVE-2025-45778
CVE-2025-45778 CVE-2025-45778：已认证存储型XSS。 The Language Sloth Web Application v1.0 中存在一个已认证存储型跨站脚本（XSS）漏洞，允许攻击者在创建新项目时，通过在"Description"文本字段中注入特制载荷来执行任意 JavaScript 或 HTML 代码。 一旦注入载荷，用户每次打开页面时都会触发该载荷。 像 alert'XSS' 这样的简单载荷就足以触发存储型XSS漏洞。 供应商已知道该漏洞，并授权发布本文。 发现致谢 Ivan Carlos Oliveira smarttfoxx, Filipe...
CVE-2025-8191
CVE-2025-8191 – Swagger UI XSS注入 描述 : 此仓库包含针对CVE‑2025‑8191的概念验证（PoC）漏洞利用代码，该漏洞存在于Swagger UI中。 该漏洞允许在“description”字段中进行跨站脚本（XSS）注入，导致在Swagger UI版本≤ 1.0.3下远程执行脚本。 参考文献 : NVD条目: https://nvd.nist.gov/vuln/detail/CVE-2025-8191 使用方法 : gcc exploit.c argparse.c -o exploit -lcurl ./exploit -u...
CVE-2021-39287-Stored-XSS
CVE-2021-39287-Stored-XSS CVE-2021-39287 TastyIgniter v3.0.7 餐厅 CMS 中的存储型 XSS 漏洞 TastyIgniter v3.0.7 餐厅 CMS 中存在一个存储型跨站脚本 XSS 漏洞。位于 /admin/locations/settings 的描述输入字段未正确过滤，允许将任意代码存储在站点内。 受影响组件 URL: /admin/locations/settings 概念验证 POC 向下滚动到 "Descriptions" 输入任意句子和任意代码： "" 保存页面，将会出现一个弹出框，显示句子 All Your...
CVE-2023-34838
CVE-2023-34838 — eScan管理控制台存储型XSS 概述 Microworld Technologies eScan管理控制台 版本 14.0.1400.2281 存在一个存储型跨站脚本XSS漏洞。拥有角色管理功能访问权限的经过身份验证的攻击者可以在新角色的 描述Description字段中注入恶意脚本。该载荷持久化保存在应用数据库中，并在随后查看受影响页面的任何用户（包括特权管理员）的浏览器中执行。 由于注入的脚本在受害者已验证会话的上下文中运行，攻击者可以利用此漏洞窃取会话Cookie、以受害者身份执行操作、将用户重定向到钓鱼页面，或在管理控制台内提升权限 。 漏洞详...
CVE-2025-46041
Anchor CMS v0.12.7 - 存储型XSS（CVE-2025-46041） Anchor CMS v0.12.7 在 /admin/pages/add 接口的 description 字段中存在一个存储型跨站脚本（XSS）漏洞。 CVE ID CVE-2025-46041 概述 类型： 存储型XSS 位置： 页面创建接口（/admin/pages/add） 影响： 可执行任意JavaScript 需要身份验证： 是（管理员或编辑用户） 受影响版本： Anchor CMS v0.12.7（发现时的最新稳定版） 概念验证 1. 登录到 /admin 2. 进入 页面 添加页面 3...
CVE-2026-18741
CVE-2026-18741 - XSS Almacenado en Worksuite SaaS Acerca de CVE-2026-18741 es una vulnerabilidad de XSS almacenado que afecta a Worksuite SaaS en versiones anteriores a la 6.0.14. El problema se encuentra en el módulo de Gestión de Activos. La entrada controlada por el usuario puede almacenarse a...
CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files
Quick CMS 存储型XSS v6.7 作者: Sergio 描述: Quick CMS v6.7 中的多个跨站脚本（XSS）漏洞允许本地攻击者通过精心编制的脚本在页面菜单中的文件 - 描述处执行任意代码。 攻击向量: 脚本注入：对“页面-文件菜单”中描述字段的清理存在漏洞，允许注入JavaScript代码，当用户访问网页时该代码将被执行。 POC: 登录面板后，我们将进入常规菜单中的“页面 - 文件”部分。 我们编辑该描述设置，发现可以在描述字段中注入任意JavaScript代码。 XSS Payload: '" 在下图中，您可以看到在主网页上执行载荷的嵌入代码。 附加信息:...
poc-cve-xss-inventory-press-plugin
更新 - 6-23-2023 CVE-2023-2579 ID 已被保留，PoC 已在 WPScan 网站上发布： https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe 详细信息 标题：InventoryPress WordPress CMS 插件中的认证反射型跨站脚本漏洞 日期：2023-04-21 作者：Danilo Albuquerque 供应商主页：https://wordpress.org 软件链接：https://wordpress.org/download 版本：WordPress 6.2...
PT-2026-98262
Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in other users' browsers via stored client-side template injection. This occurs when Vue.js template expressions, using double-brace syntax...
PT-2026-98264
Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the web form...
plone.app.dexterity has a Denial of Service due to excessive title or description length
Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...
CVE-2026-88868
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting vulnerability in the LiveLinks plugin . The root cause is that the title and description fields are stored without sanitization. An attacker holding canStream permission can inject maliciou...
MAL-2026-15878 Malicious code in cbc97b7a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...
CVE-2026-3423
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-67708
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-3423: Improper Neutralization of Input During Web Page Generation
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-83122
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-49132
OPNsense before 26.1.9 is affected by a stored XSS in the trust certificate API: when an attacker consolidates payloads into a certificate description, the unsanitized value is persisted and later rendered in the Dashboard Certificates widget (Certificates.js) via HTML attribute/text sinks, allow...
CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...