CVE-2026-78693

ash_graphql (ash-project, Elixir/Erlang) is vulnerable to incomplete error-message redaction . In AshGraphql.Errors, the configured error_handler output is merged with the pre-handler path via Map.put_new(handled, :path, path), which re-injects the original path even when a sanitizing handler rem...

CVE-2020-15053

CVE-2020-15053 : Artica Proxy anterior a 4.28.030418 Community Edition permite Cross Site Scripting Reflejado. Descripción del Producto: Artica Tech ofrece una solución potente pero fácil de usar, generalmente reservada para grandes empresas y multinacionales. Con un precio inicial de solo 99 € y...

CVE-2025-25460

FlatPress CMS Stored XSS in v1.3.1 CVE-2025-25460 Author: Athul S Description A stored Cross-Site Scripting XSS vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts...

CVE-2026-18741

CVE-2026-18741 - XSS Almacenado en Worksuite SaaS Acerca de CVE-2026-18741 es una vulnerabilidad de XSS almacenado que afecta a Worksuite SaaS en versiones anteriores a la 6.0.14. El problema se encuentra en el módulo de Gestión de Activos. La entrada controlada por el usuario puede almacenarse a...

CVE-2022-4556

CVE-2022-4556 - Stored XSS in SOGo Webmail v5.7.1 🧠 Summary A Stored Cross-Site Scripting XSS vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface , affecting version 5.7.1. An authenticated attacker could inject a malicious script that...

FOFA-API-Threaded-Searcher

FOFA API Threaded Searcher A powerful multi‑threaded Python tool to query the FOFA Fofa.so API, extract selected fields, and save unique results with intelligent formatting. ✨ Features Multi‑threaded – Fetch multiple pages concurrently configurable threads Custom fields – Choose any valid FOFA...

CVE-2025-25461

📌 CVE-2025-25461 - Stored Cross-Site Scripting XSS in SeedDMS 6.0.29 📝 Description A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is...

CVE-2022-24654

CVE-2022-24654 PoC of CVE-2022-24654 - INTELBRAS ATA 200 Firmware 74.19.10.21 Authenticated stored Cross Site Scripting Steps to Reproduce: 1. Log in the equipment via your web browser 2. Go to Management Syslog 3. In the "Field Server Address" inject the payload "-prompt"XSS"-" 4. Click Save 5...

CVE-2017-14980_syncbreeze_10.0.28_bof

Exploit - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 This repository contains a proof-of-concept buffer overflow exploit BOF for Sync Breeze Enterprise version 10.0.28, targeting the vulnerability identified as CVE-2017-14980. Description The vulnerability exists due to improper input...

CVE-2026-81660

CVE-2026-81660 affects the Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin in versions prior to 4.5.13 . The vulnerability stems from insufficient validation and escaping of values submitted to optional web form dropdown and radio fields , which are then stored and render...

PT-2026-83629

Name of the Vulnerable Software and Affected Versions ash graphql versions 1.9.0 through 1.10.x Description A remote client can read internal field names that an application configured its error handler to redact. In AshGraphql.Errors, errors are processed by the error handler and merged using...

PT-2026-83518

Name of the Vulnerable Software and Affected Versions ash sqlite versions 0.1.2-rc.0 through 0.2.17 Description Improper neutralization of special elements in data query logic allows an attacker to traverse into nested JSON data that the application did not intend to expose, potentially disclosin...

CVE-2024-57175

CVE-2024-57175: Cross-Site Scripting XSS Memorizzato in PHPGURUKUL Online Birth Certificate System v1.0 Descrizione Una vulnerabilità di Cross-Site Scripting XSS Memorizzato è stata identificata in PHPGURUKUL Online Birth Certificate System v1.0 nella pagina /user/certificate-form.php. Questa...

CVE-2025-50363_BXSS_CVE

Nome del progetto e URL del repository: Maid Hiring Management System using PHP and MySQL Tipo di vulnerabilità: Escalation dei privilegi tramite Blind XSS Versionei interessatae: v1.0 💣Descrizione della vulnerabilità: È stata scoperta una vulnerabilità di Blind Cross-Site Scripting XSS nel Maid...

CVE-2021-39473

CVE-2021-39473 Base di codice del prodotto interessato HotelManager - v1.2 Componente interessato Kernel.php; Middleware Tipo di attacco Remote Vettori di attacco Per sfruttare questa vulnerabilità, l'utente deve creare "stanze" o "ospiti" o "prenotazioni" o "utenti" e nel campo "commento" o...

google_gax

googlegax con patch Fork con patch di googlegax v0.4.1 per la compatibilità con Tesla = 1.18.3. Perché esiste questo fork Tesla 1.18.3 2 giugno 2026 ha introdotto una validazione rigorosa dei nomi dei campi multipart tramite assertquotedstringsafe!/2 come parte delle correzioni di sicurezza per...

CVE-2024-50335

CVE-2024-50335: XSS autenticato nel campo "Publish Key" che consente la creazione non autorizzata di utenti amministratori Sommario Il campo "Publish Key" nella pagina Edit Profile di SuiteCRM è vulnerabile a Cross-Site Scripting XSS riflesso, consentendo a un attaccante di iniettare codice...

CVE-2024-51026_Overview

CVE-2024-51026 - Vulnerabilità di Cross Site Scripting XSS in NetAdmin IAM Descrizione Il sistema NetAdmin IAM versione 4.0.30319 presenta una vulnerabilità di Cross Site Scripting XSS nell'endpoint /BalloonSave.ashx, dove è possibile iniettare un payload dannoso nel campo Content=. Qualsiasi...

CVE-2024-25412

CVE-2024-25412 Uma vulnerabilidade de cross-site scripting XSS no Flatpress v1.3 permite que atacantes executem scripts web ou HTML arbitrários através de uma carga maliciosa inserida no campo de email Tipo de Vulnerabilidade: Cross Site Scripting XSS Fornecedor do Produto:...

poc-cve-xss-inventory-press-plugin

Aggiornamento - 23/06/2023 L'ID CVE-2023-2579 è stato riservato e il PoC è stato pubblicato sul sito WPScan: https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Dettagli Titolo: Cross-Site Scripting Riflesso Autenticato nel Plugin InventoryPress per WordPress CMS Data: 2023-04-2...