CVE-2021-42558

CVE-2021-42558: Mehrere Cross-Site-Scripting-Schwachstellen in MITRE Caldera Caldera Versionen =2.8.1 enthält mehrere reflektierte, persistente und Self-XSS-Schwachstellen, die sowohl von authentifizierten als auch nicht authentifizierten Angreifern ausgenutzt werden können. Offenlegung durch den...

CVE-2017-7038

CVE-2017-7038 XSS no Safari CVE-2017-7038 https://support.apple.com/en-us/HT207923 Vulnerabilidade XSS na implementação de Document root@kitploit: var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM-XSS-Exploit 📋 Exploit-Informationen Exploit-Titel: Roundcube Webmail DOM XSS über SVG href CVE-2026-25916 Autor: Mohammed Idrees Banyamer Kontakt: GitHub @mbanyamer | Instagram @banyamersecurity Land: Jordanien Datum: 9. Februar 2026 CVE: CVE-2026-25916 Typ:...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

PoC-CVE-2024-24035

CVE-2024-24035 Titre : Le SIL 3.1 est vulnérable à un script intersites XSS dans le paramètre « hmessage ». Date : 2024-01-14 Auteur : Elizeu Das Dores Page d'accueil du fournisseur : https://www.setorinformatica.com/ Version : 3.1 POC CVE-2024-24035 Le paramètre « hmessage » est vulnérable à un...

CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-

Target:http://117.72.165.13:8888/ Github:https://github.com/201206030/novel Version:V3.5.0 भेद्यता का नाम: novel V3.5.0 में DOM-आधारित क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता CWE-79 भेद्यता प्रकार: DOM-आधारित क्रॉस-साइट स्क्रिप्टिंग DOM-आधारित XSS खोज की तिथि: 2025-11-02...

CVE-2022-45472

CVE-2022-45472 XSS Baseado em DOM Software: CAE Learning Space Enterprise with Intuity License Versão da Imagem: 267r Patch Level: 639 Vulnerabilidade: XSS Baseado em DOM Descrição O software de gerenciamento CAE Learning Space Enterprise é vulnerável a um ataque XSS Baseado em DOM. Um ataque XSS...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS Esta prova de conceito demonstra uma falha de segurança de XSS baseado em DOM manipulando e usando métodos DOM do JQuery. Ex: .append, .text, .html Payload que usei: alert"Text: " + $"test".text; Para testar a vulnerabilidade, faça o seguinte: 1. Abra o console da web, ...

CVE-2024-28715

CVE-2024-28715 CVE ID CVE-2024-28715 제품 DoraCMS 버전 DoraCMS v2.18 및 이전 버전 문제 유형 DOM 기반 XSS. 설명 DOraCMS v2.18 및 이전 버전의 XSS교차 사이트 스크립팅 취약점으로, 원격 공격자가 /app/public/apidoc/oas3/wrap-components/markdown.jsx 엔드포인트의 markdown0 함수를 통해 임의 코드를 실행할 수 있습니다. 사용법...

CVE-2021-24891-Simulation

Um ambiente de laboratório prático e containerizado para simular e explorar uma vulnerabilidade de Cross-Site Scripting XSS baseada em DOM no plugin Elementor Website Builder para WordPress, identificada como CVE-2021-24891. 📖 Sobre a Vulnerabilidade Este laboratório demonstra uma vulnerabilidade...

NoXss

NoXss NoXss è uno scanner di vulnerabilità di cross-site scripting che supporta reflected XSS e DOM-based XSS. È molto veloce e adatto per testare milioni di URL. Ha trovato alcune vulnerabilità XSS in programmi Bug Bounty. Caratteristiche Veloce e adatto per testare milioni di URL Supporto...

burp-dom-scanner

Burp DOM Scanner É uma extensão do Burp Suite que permite rastreamento e escaneamento recursivo de Single Page Applications. Ele executa um navegador Chromium para escanear a página web por XSS baseado em DOM. Ele também pode coletar todas as requisições XHR, fetch, websockets, etc emitidas duran...

security-advisories

🔐 Avisos de Segurança por Minhajul Taivin Bem-vindo ao repositório oficial das minhas divulgações de CVE publicadas. Este repositório contém avisos de segurança detalhados, informações de prova de conceito, estratégias de mitigação e análise técnica para vulnerabilidades que descobri. 📌 CVEs...

CVE-2024-30956

CVE-2024-30956 veja https://www.lauyan.com/en/toweb-updates.htmliyFEw37D Vulnerabilidade de injeção HTML XSS baseado em DOM na versão 5 por exemplo http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navegue até a URL, o código JS é executado PS: src contém...

CVE-2026-18328

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18328

The Forminator Forms WordPress plugin (all versions up to and including 1.57.0 ) is vulnerable to DOM-Based Reflected Cross-Site Scripting via the error_description parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

EUVD-2026-65316

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...