firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: Push Subscriptions component...

firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: UI Events & Focus Handling component...

firefox: thunderbird: Privilege escalation in the DOM: Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Networking component...

firefox: thunderbird: Privilege escalation in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: UI Events & Focus Handling component...

firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: Push Subscriptions component...

CVE-2021-42558

CVE-2021-42558: Múltiples Cross-Site Scripting en MITRE Caldera Caldera versiones =2.8.1 contiene múltiples vulnerabilidades XSS reflejadas, almacenadas y propias que pueden ser explotadas por atacantes autenticados y no autenticados. Divulgación del proveedor: La divulgación del proveedor para...

React2Shell-CVE-2025-55182

🎯 React2Shell CVE-2025-55182: From React Server Components to Full RCE Difficulty: Intermediate → Advanced Category: Web Exploitation | Deserialization | RCE 🧩 Task 1: Introduction — Why React2Shell Is a Big Deal CVE-2025-55182, nicknamed React2Shell , is one of those vulnerabilities that instant...

CVE-2024-30956

CVE-2024-30956 cf https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-based XSS HTML Injection vulnerability in TOWeb version 5 eg http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navigate to the url, the JS code is executed PS: src contains a copy ...

PT-2026-86990

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prom...

Yonyou U8 13.0 - Cross-Site Scripting

Yonyou U8 13.0 contains a DOM-based cross-site scripting vulnerability via the component /u8sl/WebHelp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

domato

Domato 🍅 Un fuzzer de DOM Escrito y mantenido por Ivan Fratric, [email protected] Copyright 2017 Google Inc. Todos los derechos reservados. Licenciado bajo la Apache License, Versión 2.0 la "Licencia"; no puede utilizar este archivo excepto en cumplimiento de la Licencia. Puede obtener una...

CVE-2025-55182

Vulnerabilidad React2Shell - CVE-2025-55182 📓 Introducción Esta vulnerabilidad, conocida como React2Shell, fue descubierta en diciembre de 2025 y afecta a componentes de next.js con una CVSS 10.0. Con una simple solicitud POST, es posible obtener un RCE crítico sin autenticación. A continuación s...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...

CVE-2025-55182-analysis

1. Resumen de la vulnerabilidad Estos días se ha hablado mucho de una vulnerabilidad RCE por deserialización en React, con una puntuación CVSS oficial de 10.0, igual que Log4j en su momento. No pocos rumores la calificaban como el Log4j del frontend moderno, causando pánico entre desarrolladores...

React2Shell-CVE-2025-55182-An-lise-T-cnica

React2Shell CVE-2025-55182 📖 Visión General Este repositorio documenta los conceptos de seguridad estudiados en la sala de TryHackME referente al CVE-2025-55182 , una vulnerabilidad crítica que afecta: React Server Components RSC Next.js y frameworks basados en RSC Paquetes:...

react2shell-rce-autobot

🔍 React2Shell Dork Scanner 🚨 Acerca de la Vulnerabilidad React2Shell es una vulnerabilidad crítica de Ejecución Remota de Código RCE que afecta: Target| Versión Vulnerable ---|--- ⚛️ react-server-dom-webpack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️ react-server-dom-turbopack| 19.0.0, 19.1.0, 19.1.1,...