CheckFlashPlayerVersion

CheckFlashPlayerVersion Vérifie la version de FlashPlayer du navigateur pour savoir si elle est vulnérable à l'exploit CVE-2016-7855 Usage: Clonez ce dépôt puis ouvrez le fichier html dans le navigateur où vous souhaitez vérifier la version de Flash Player...

CVE-2022-30190

CVE-2022-30190 ВАЖНО Исправлено по состоянию на: 14 июня 2022 г. Обновления безопасности Отчёт CVE HTML-файл должен быть передан цели, например exploit.html Простой способ запустить атаку — запустить server.py...

CVE-2022-44311

Description pour CVE-2022-44311 Il a été découvert que html2xhtml v1.3 contient une lecture hors limites dans la fonction static void elmclosetreenodet nodo dans procesador.c. Cette vulnérabilité permet à des attaquants d'accéder à des fichiers sensibles ou de provoquer un déni de service DoS via...

CVE-2023-33733

CVE-2023-33733 dans Reportlab v3.6.12 Ce laboratoire a été mis en place pour tester CVE-2023-33733. Processus d'analyse Vous pouvez voir notre processus d'analyse de cette CVE dans le fichier PDF sur le dépôt principal. Installation et Exécution Serveur Installation pip3 install -r requirements.t...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ ---...

cve_2013_3893_trigger.html

В этом репозитории нет README...

Reachability-Check

Vérification d’Accessibilité 🌐 EN | TR Vérificateur d’accessibilité basé sur le navigateur — testez la connectivité réseau, les règles de pare-feu et les restrictions d’accès. Fichier HTML unique. Zéro dépendance. Aucun serveur web nécessaire pour fonctionner. Fonctionnalités Double mesure : HTTP...

CVE-2021-30573

CVE-2021-30573-PoC-Google-Chrome Vulnérabilité Use After Free de Google Chrome signalée Récompense totale du Bug Bounty : $6.000 Ceci est une preuve de concept pour : Google SecuritySeverity CVE. HIGH CVE-2021-30573 https://vulners.com/cve/CVE-2021-30573 Article de blog Google :...

CVE-2021-3395

CVE-2021-3395 Description suggérée Une vulnérabilité de script intersite XSS dans Pryaniki 6.44.3 permet aux utilisateurs authentifiés distants de téléverser un fichier arbitraire. Le code JavaScript s'exécutera lorsque quelqu'un visitera la pièce jointe. Type de vulnérabilité Cross Site Scriptin...

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

PT-2026-89108

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions 0.94 through 109.6 Description A stored cross-site scripting issue exists in the admin page upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the uploads/ pages/...

PT-2026-60099

Name of the Vulnerable Software and Affected Versions EasyAdmin affected versions not specified Description Stored Cross-Site Scripting XSS occurs because FileField and ImageField accept browser-executable file types by default. FileField applies no MIME or extension restrictions, while ImageFiel...

PT-2026-59357

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

GHSA-8GH5-QQH8-HQ3X Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

CVE-2026-36163

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file...

CVE-2026-36163: Improper Neutralization of Input During Web Page Generation

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file...

CVE-2026-13323

Vulnerability CVE-2026-13323 affects Open VSX Registry before 1.0.2. The /vscode/unpkg/ endpoint serves user-supplied HTML without CSP or Content-Disposition headers, enabling a publisher to upload a crafted VSIX and lure authenticated users to visit the URL. This inline rendering in the open-vsx...

CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/ and /file/:fileFolder/:id serve uploaded files using fileStream.piperes without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an...

CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/ and /file/:fileFolder/:id serve uploaded files using fileStream.piperes without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an...

CVE-2026-9053: Undefined Security Weakness

Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element...