CVE-2024-25293

PoC de Ejecución de Código Local en MJML Una Prueba de Concepto para la vulnerabilidad CVE-2024-25293. Se descubrió que mjml-app v3.0.4 y 3.1.0-beta contienen una vulnerabilidad de ejecución remota de código RCE. En este repositorio hay una aplicación vulnerable de ejemplo y un exploit de prueba ...

CVE-2022-46364-Poc

CVE-2022-46364 利用工具 Apache CXF 通过 MTOM XOP:Include 的 SSRF | CVSS 9.8 严重 漏洞 Apache CXF -s -d -t, --target - 易受攻击的 CXF SOAP 端点（必需） -s, --ssrf-url - 要窃取的内部 URL（必需） -d, --domain - 目标域名（默认：localhost） --plain-soap - 使用纯 SOAP 而非 MTOM 示例 root@kitploit: Read /etc/passwd python3 exploit.py -t...

CVE-2022-44666

Microsoft Windows Contacts VCF/Contact/LDAP syslink 控制 href 属性转义漏洞 CVE-2022-44666 0day. 这是一个关于另一个被遗忘的0day的故事，它在4年多前由 John Page 又名 hyp3rlinxR.1 完全公开。要理解这份报告，你必须考虑我很笨 :- 而我的笨拙驱使我走更长的路来解决简单的问题，但也让我找到了利用某些漏洞的其他方法。我为什么这么说？因为我无法迅速理解创建 .contact 文件的方法只是浏览到联系人文件夹来创建联系人，相反，我利用这些信息首先创建了一个 VCF...

Mailcow < 2026-03b - Href Link Injection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. id: CVE-2026-40878 info: name: Mailcow 2026-03b - Href Link Injection author: ritikchaddha severity: low description: | mailc...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check 是一个简单的 Python 脚本，用于验证 Astro 框架中 /image 端点上的 SSRF（服务器端请求伪造）/ Content Spoofing（内容欺骗）漏洞。 该漏洞被跟踪为 GHSA-qpr4-c339-7vq8 和 CVE-2025-58179。 漏洞背景 该漏洞影响使用 @astrojs/cloudflare 适配器并配置了 output: 'server' 的 Astro 站点。本应优化图片的 /image 端点未能正确验证 href 参数。...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF（文件读取） 针对 CVE-2022-46364 的概念验证（PoC）利用程序 —— Apache CXF 在 MTOM/XOP 请求处理中的服务端请求伪造（SSRF）漏洞。 漏洞概述 CVE-2022-46364 影响 3.4.10 和 3.5.5 之前版本的 Apache CXF。当 SOAP 服务启用 MTOM（消息传输优化机制）时，CXF 反编组器会对 元素内的 href 属性校验不当。CXF 并未按要求将 href 限制为 cid: URI（W3C XOP 规范要求如此），而是解引用了任意 URI...

CVE-2026-89253

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

EUVD-2026-76056

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

UBUNTU-CVE-2026-61909

CalDAV/CardDAV multiget bypasses per-href ACL: An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT...

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

CVE-2026-82659

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

EUVD-2026-63686

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

CVE-2026-16079 Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

PT-2026-73094

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

SUSE CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

SUSE CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73648

A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting XSS by exploiting improper sanitization of SVG Scalable Vector Graphics reference elements. The...

CVE-2026-73648 rails-html-sanitizer: Possible XSS vulnerability with certain configurations

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-73648 rails-html-sanitizer: Possible XSS vulnerability with certain configurations

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...