TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125

Stored XSS exploit in TYPO3 HTML Sanitizer CVE-2023-47125 Description DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Vuln versions = 1.0.0, = 2.0.0,...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

CVE-2026-64638

CVE-2026-64638 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

viber-desktop-html-injection

Viber Desktop — HTML Injection CVE-2025-55996 CVE: CVE-2025-55996 Discoverer: Thaw Khant Cycbake Product: Viber Desktop Affected: Viber Desktop 25.6.0 and possibly earlier Summary Viber Desktop's deep-link handler viber://forward?text= can render unsanitized HTML supplied in the text parameter...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...

CVE-2025-53693

CVE-2025-53693: HTML Cache Poisoning The XAML handler, located at /-/xaml/, exposes several controls that can be accessed without authentication. The AjaxScriptManager within these controls allows for the execution of methods via reflection. The AddToCache method can be abused to inject arbitrary...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

CVE-2024-30956

CVE-2024-30956 cf https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-based XSS HTML Injection vulnerability in TOWeb version 5 eg http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navigate to the url, the JS code is executed PS: src contains a copy ...

prometheus

Installing Prometheus Prometheus is a Ruby application and will run on any system running a recent version 1.8.7 or higher of Ruby. To install Prometheus use the following steps: 1. Create a directory called prometheus. 2. Extract the prometheus files into the directory. 3. CD into the prometheus...

JCS

JCS Joomla Component Scanner made for penetration testing purpose on Joomla CMS JCS can help you with the latest component vulnerablities and exploits. Database can update from several resources and a Crawler has been implemented to find components and component's link. This version supports...

httprobe

httprobe Take a list of domains and probe for working http and https servers. Install ▶ go install github.com/tomnomnom/httprobe@latest Basic Usage httprobe accepts line-delimited domains on stdin: ▶ cat recon/example/domains.txt example.com example.edu example.net ▶ cat recon/example/domains.txt...

maigret

Maigret English · 简体中文 · Français 📖 Documentation Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors Noimosiny is a comprehensive...

CVE-2020-6418

CVE-2020-6418 The CVE 2020-6418 is about the the type confusion in V8 in Google chrome.The affected versions were prior to 80.0.3987.122. The vulnerability is achived by remote attacker accessing the shell of a target device via a crafted HTML page. Environment Requirements 1. Google Chrome with...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2021-29267

CVE-2021-29267 SherlockIM ChatBot XSS Suggested description: SherlockIM is vulnerable to Persistent XSS. Additional Information: SherlockIM - Platform for manage all kind of conversations with customers. Vulnerability Type: Cross Site Scripting XSS A letter was sent to the vendor about the...

CVE-2025-22131-PoC

CVE-2025-22131-PoC PoC for CVE-2025-22131 PhpSpreadsheet is a library written in pure PHP and offers a set of classes that allow you to read and write various spreadsheet file formats such as Excel and LibreOffice Calc. phpspreadsheet version =2.2.0, =2.0.0, =3.0.0, sheetIndex === null $sheets =...

EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...