Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

wwwgrep

WWWGrep OWASP Foundation Web Respository Author: Mark Deen & Aditi Mohan Introduction WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed...

Linux Distros Unpatched Vulnerability : CVE-2026-92883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

CrushFTP HTML Injection

CrushFTP before version 11.3.760 contains an HTML injection vulnerability where a shared filename is reflected unsanitized in an email body. The archive includes reproduction details...

CVE-2026-111932: Improper Neutralization of Input During Web Page Generation

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Supports Java 7+. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Supports Java 8+. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc...

tryhackme-moniker-link

tryhackme-moniker-link Documentation of my hands-on lab Moniker Link CVE-2024-21413 completed on TryHackMe. Moniker Link CVE-2024-21413 — TryHackMe Lab Overview This repository documents my hands-on study in a TryHackMe room. The goal of this exercise was to understand how the vulnerability works...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Yordam-Kütüphane-Otomasyonunda-Çoklu-HTML-Enjeksiyonu CVE-2026-77818 · CVSS 3.1 6.1 Orta · Siber Güvenlik Başkanlığı · Yayımlanma 2026-09-04 · TR-26-1011 Durum: Zafiyetler v22.2 sürümünde giderilmiştir. Etkilenen kurulumların v22.2 veya üzerine yükseltilmesi gerekmektedir. Genel Bakış Yordam...

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 Pandoc SSRF POC A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Install Pandoc https://pandoc.org/installing.html Payload Example ⚠️ replace iframe url to your own OAST...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2022-44311

Description for CVE-2022-44311 html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elmclosetreenodet nodo at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service DoS via a crafted html file. Reproduction T...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-71497

Summary Vulnerability in jsoup.jar in IBM Integration Designer: CVE-2026-71497 Vulnerability Details CVEID:CVE-2026-71497 DESCRIPTION: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a...

cve-disclosures

CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...

unwaf

Unwaf Unwaf is a Go tool designed to help identify WAF bypasses using passive techniques. It automates the process of discovering the real origin IP behind a WAF/CDN by combining multiple discovery methods and verifying candidates through HTML similarity comparison, SSL certificate fingerprinting...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...

SUSE CVE-2026-110916

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 fast try import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text or POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000 Content-Typ...