CVE-2023-49052

CVE-2023-49052 - Microweber CMS v2.0.4 - Caricamento di file dannosi Descrizione Nella versione 2.0.4 di Microweber CMS, quando l'opzione di upload di file è attiva nei moduli creati, è possibile inviare file HTML dannosi, anche quando vengono applicati determinati tipi di validazioni in questo...

CVE-2022-30781

🍵 CVE-2022-30781 Exploit di esecuzione remota di comandi tramite migrazione repository Gitea. Come usare 1. Esegui un server filesystem HTTP con i file in questo repository. 2. Modifica il comando da eseguire in api/v1/repos/e99/exp/pulls/1/index.html L96. 3. Migra un repository remoto con URL...

EUVD-2026-67403

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

viber-desktop-html-injection

Viber Desktop — HTML Injection CVE-2025-55996 CVE: CVE-2025-55996 Discoverer: Thaw Khant Cycbake Product: Viber Desktop Affected: Viber Desktop 25.6.0 e possibilmente versioni precedenti Riepilogo Il gestore dei deep-link di Viber Desktop viber://forward?text= può renderizzare HTML non sanitizzat...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection

CVE-2021-46079 Titolo dell'exploit: Vehicle Service Management System - 'Multiple' File upload Leads to Html Injection Autore dell'exploit: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 HIGH Riferimenti: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injectio...

CVE-2021-46079

CVE-2021-46079 Titolo dell'Exploit: Vehicle Service Management System - 'Multiplo' Caricamento file porta a Iniezione HTML Autore dell'Exploit: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 ALTO Riferimenti:...

EUVD-2026-67170

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Klick-Schwachstelle zur Ausführung beliebigen Codes. CVE-2022-21241 ⚠ Dieser PoC wurde erstellt, um Benutzer zu warnen und Schwachstellen in ihrer eigenen CSV+ zu untersuchen. Die Nutzung für Angriffe ist untersagt. Schwachstelle Die folgenden Versionen sind betroffen...

CVE-2023-2859

CVE-2023-2859: Iniezione HTML persistente in folderName che colpisce l'Admin in TeamPass 3.0.9 - M Nadeem Qazi Ciao, Ho trovato una vulnerabilità grave nell'applicazione nilsteampassnet/teampass che coinvolge l'iniezione HTML persistente nel campo FolderName. Inserendo codice HTML malevolo nel...

CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi Recentemente ho identificato una vulnerabilità di sicurezza in nilsteampassnet/teampass, un popolare strumento di gestione delle password. Questa vulnerabilità, identificata come CVE-2023-2591, è un'iniezione HTM...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

CVE-2026-81820

Flowintel versions greater than 3.3.0 are vulnerable to HTML injection in the MISP case history timeline. Attacker-controllable MISP object fields (object UUID, name, attribute value, attribute type, comment, first/last seen, and IDS flag) were concatenated directly into HTML strings before rende...

CVE-2026-81820 Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-81820 Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-48060

CVE-2026-48060 - Injeção de HTML no Litestar Através do Token CSRF Este repositório contém a prova de conceito do exploit e a aplicação vulnerável para demonstrar a vulnerabilidade de injeção de HTML presente na versão 2.21.0 do Litestar. Como Executar root@kitploit: git clone...

LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

शोषण शीर्षक: LetterPress CLICK THIS" कोड डालें और Save Campaign पर क्लिक करें। 2. कैम्पेन देखें और "CLICK THIS" हाइपरलिंक पर क्लिक करें, यह तीसरे पक्ष की साइट पर रीडायरेक्ट करेगा। जैसे: evil.com...

CVE-2026-5218

Softtr Informatics Technology Trading Limited Company E-Commerce Pack (before 5.03.01.49 ) is affected by an improper neutralization of script-related HTML tags (basic XSS), allowing Cross-Site Scripting in a web page. The vulnerability is rated CVSS 4.3 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S...

CVE-2026-5218 HTML Injection in Softtr's E-Commerce Pack

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

cve-2026-64638-banner-poc

CVE-2026-64638 — PoC Banner Universale Un generatore di PoC a file singolo, senza dipendenze, per l'iniezione HTML riflessa CVE-2026-64638 di WordPress su wp-login.php differenziale tra striptags e il parser KSES. Produce una pagina trigger auto-inviante: quando la vittima apre il file, la pagina...