Instatic-Stored-XSS-CVE-2026-103931

Обход фильтра URL-схем в isSafeUrl с помощью ведущих управляющих символов C0 Затронуто: Instatic v0.0.13 / коммит 63ad5d6 и все более ранние ревизии, содержащие src/core/html-sanitize/index.ts Компонент: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Класс: CWE-79 хранимая XSS через CWE-18...

CVE-2025-26633

CVE-2025-26633 - MSC EvilTwin PoC Proof of Concept PoC for CVE-2025-26633 vulnerability exploiting Microsoft Management Console MMC About This PoC simulates the CVE-2025-26633 vulnerability, discovered by Trend Micro, which exploits the loading of malicious .msc files for remote command execution...

decode-spam-headers

decode-spam-headers.py Независимо от того, пытаетесь ли вы понять, почему конкретное письмо попало в SPAM/Junk в рамках повседневных административных обязанностей или для целей Red-Team фишинг-симуляций, этот скрипт создан, чтобы помочь вам! Идея возникла при проведении коммерческих упражнений по...

CVE-2026-50980

CVE-2026-50980: DNS-Based Cross-Site Scripting XSS & Session Hijacking in oPanel Overview CVE ID: CVE-2026-50980 Product: oPanel Affected Versions: v1.20.25 Vulnerability Type: Stored Cross-Site Scripting XSS via DNS / Session Hijacking Severity: High CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N...

CheckFlashPlayerVersion

CheckFlashPlayerVersion Check the Browser's FlashPlayer version to check if it is vulnerable to exploit CVE-2016-7855 Usage: Clone this repository and then open the html file in the browser where you want to check the Flash Player version...

CVE-2025-55780

CVE-2025-55780 Null Pointer De-reference in MuPDF 1.26.4 EPUB Rendering Function CVE Reference - CVE-2025-55780 Affected Versions : 1.26.7 and before are affected Found and tested on : 1.26.4 Severity CVSSv3 score : 7.5 High Fixed in commit :...

CVE-2020-16947

CVE-2020-16947 This vulnerability occurs in Outlook 2019 16.0.13231.20262 installed on Windows 10 1909 x64 TLDR; I found this bug using winafl fuzzer. This bug occured when parsing html contents. if attacker successfully executes this exploit, it can lead to remote command execution. Details 0:00...

CVE-2026-88783

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

ie11_vbscript_exploit

IE11 VBScript Exploit Exploit Generator for CVE-2018-8174 & CVE-2019-0768 RCE via VBScript Execution in IE11 Prerequisite Metasploit msfvenom Usage python ie11vbscript.py Listener IP Listener Port Instruction 1. Use this script to generate "exploit.html" 2. Host the html file on your server 3...

CVE-2026-95323

An ui misrepresentation flaw was found in the Chromium component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/546438368...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

CVE-2026-95321

An ui misrepresentation flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/545879261...

CVE-2026-103626

An incorrect authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553114097...

CVE-2026-95330

An improper state validation flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517163294...

CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-96270

The Ultimate Member plugin for WordPress (versions up to and including 2.13.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'form_id' parameter. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-95337

An ui misrepresentation flaw was found in the Messages component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514019137...

CVE-2026-104477

A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to...