108 matches found
CVE-2023-2255
CVE-2023-2255 CVE-2023-2255 RCE & load of external ressources found by @Icare1337 https://nvd.nist.gov/vuln/detail/CVE-2023-2255 Exploit Just an example to drop a webshell in current directory. python3 CVE-2023-2255.py --cmd 'wget...
sonar.js
sonar.js A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar....
EUVD-2026-111386
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass...
CVE-2026-91858
CVE-2026-91858 — camel-fop: XML External Entity XXE via a third-party TransformerFactory Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-fop's FopProducer created its javax.xml.transform.TransformerFactory with only FEATURESECUREPROCESSING before running an...
CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
svg-sanitizer
SVG Sanitizer SVG Sanitizer is a Java library designed to clean SVG files by removing potentially dangerous JavaScript, blocking external resource loading, and preventing XSS Cross-Site Scripting vulnerabilities. It is useful for ensuring that SVG files are safe to use in a variety of application...
DEBIAN-CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
UBUNTU-CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695
The Crass Ruby CSS parser (prior to version 1.0.8 ) is vulnerable to a CSS sanitizer bypass due to incorrect tokenization of bad URLs. The parser treats a closing parenthesis following an escaped backslash as escaped, causing it to retain declarations or style rules within a bad URL token that a ...
PT-2026-127228
Name of the Vulnerable Software and Affected Versions Crass versions prior to 1.0.8 Description Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped when consuming the remnants of a bad URL. This causes declarations, style rules, or at-rules to remain inside a bad...
Exploit for CVE-2026-91858
CVE-2026-91858 — camel-fop: XML External Entity XXE via a th...
CVE-2026-91858
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...
CVE-2026-91858
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...
PT-2026-117366
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURE SECURE PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...
morty
Morty Proxy de saneamiento de contenido web como servicio Morty reescribe páginas web para excluir etiquetas y atributos HTML maliciosos. También reemplaza referencias a recursos externos para evitar filtraciones de información a terceros. El objetivo principal de morty es proporcionar un proxy d...