CVE-2026-104470

Versions of YesWiki before 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Bazar valeur action . This flaw allows authenticated page editors to force the server to fetch arbitrary URLs by providing them via the url parameter . By embedding this action with a ...

EUVD-2026-91424

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2020-11022

Así que así Así que, amigos, CVE-2020-11022 es una vulnerabilidad en jQuery por debajo de la versión 3.5.0 o superior. La vulnerabilidad CVE-2020-11022 en sí misma desencadena un XSS aprovechando la manipulación del DOM como .html, .append, y otras para ejecutar código XSS malicioso. 1. Verificar...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 prueba rápida import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text o POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

sunsetscan

SunsetScan Network security auditing for humans — powered by nmap, built for everyone. Website: sunsetscan.com SunsetScan is a local-network security auditing tool for home network owners and IT staff who want the depth of nmap without learning nmap syntax. Point it at your network and it finds...

CVE-2026-93756 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin (all versions up to and including 4.13.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping when handling Facebook Comment Messages via v-html in...

EUVD-2026-91253

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...

CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2025-70849

CVE-2025-70849: XSS almacenado en Podinfo Resumen Se identificó una vulnerabilidad de seguridad CWE-79 en Podinfo , una aplicación web para demostrar microservicios de Kubernetes. La funcionalidad /store permite a usuarios no autenticados cargar contenido HTML/JS arbitrario, lo que conduce a XSS...

wwwgrep

WWWGrep OWASP 基金会网站仓库 作者：Mark Deen & Aditi Mohan 简介 WWWGrep 是一种快速搜索的“grep”机制，它按类型检查 HTML 元素，允许执行集中式（单个）、多文件（基于文件的 URL）以及递归式（可选择是否基于根域名）搜索。页面头部的名称和值也可以按此方式递归搜索。WWWGrep 旨在帮助攻击方和防御方快速审查待检查的代码库，以下列举了一些用例和示例。 安装 git clone pip3 install -r requirements.txt python3 wwwgrep.py 依赖项（pip3 install -r...

VUL4J-59

jsoup: analizador HTML en Java que da sentido al HTML del mundo real. jsoup es una biblioteca Java para trabajar con HTML del mundo real. Proporciona una API muy conveniente para extraer y manipular datos, utilizando lo mejor de DOM, CSS y métodos similares a jQuery. jsoup implementa la...

VUL4J-60

antisamy Una biblioteca para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para su perfil, comentarios...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

authcov

AuthCov Web 应用程序授权覆盖扫描。 简介 AuthCov 使用 Chrome 无头浏览器，以预定义用户的身份登录，爬取您的 Web 应用程序。在爬取阶段，它会拦截并记录 API 请求以及加载的页面。下一阶段，它会以另一个用户账户（即“入侵者”）登录，并尝试访问之前发现的每一个 API 请求或页面。对于定义的每个入侵者用户，重复此步骤。最后，它会生成一份详细报告，列出发现的资源以及入侵者用户是否能够访问这些资源。 扫描本地 Wordpress 实例生成的示例报告： 功能特性 支持单页应用和传统多页应用 处理基于令牌和基于 Cookie 的身份验证机制 生成 HTML 格式的深入...

LinkedInt

赞助开源工具开发 欢迎赞助我以维护该工具：https://github.com/sponsors/vysecurity 免责声明 本项目仅用于教育和测试目的。 作者 LinkedInt 由 Vincent Yiu @vysecurity 开发：https://www.vincentyiu.com | https://vysecurity.rocks 原始爬虫由 Danny Chrastil @DisK0nn3cT 编写：https://github.com/DisK0nn3cT/linkedin-gatherer 贡献者： Leesoh harshil-shah004 安装 git...