116449 matches found
SmuggleMyPayload
SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...
SUSE CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2025-66470
NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...
CVE-2026-64638
CVE-2026-64638 CVE-2026-64638 fast try import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text or POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000 Content-Typ...
CVE-2026-100785
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...
CVE-2026-100780
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...
CVE-2026-100772
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...
CVE-2026-104003
The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...
BIT-GOLANG-2026-97030 Recognize yield as regexp preceder keyword in html/template
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
BIT-GOLANG-2026-94448 Reset context tracking on consecutive template expressions in html/template
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
CVE-2026-109232
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2026-109232
The Salon Booking System WordPress plugin (versions up to and including 10.31.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'sln[]' parameter. This flaw allows unauthenticated attackers to inject arbitrary...
CVE-2026-109232 Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2025-70849
CVE-2025-70849: Stored XSS in Podinfo Summary A security vulnerability CWE-79 was identified in Podinfo , a web application for demonstrating Kubernetes microservices. The /store feature allows unauthenticated users to upload arbitrary HTML/JS content, leading to Stored XSS. Vulnerability Details...
VUL4J-59
jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...
authcov
AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...
LinkedInt
Sponsor Open Source Tooling Feel free to sponsor me for maintaining the tool: https://github.com/sponsors/vysecurity Disclaimer The project is to be used for educational and testing purposes only. Authors LinkedInt by Vincent Yiu @vysecurity: https://www.vincentyiu.com | https://vysecurity.rocks...
CSRF-exploit-generator
CSRF-exploit-generator The CSRF Exploit Generator allows users to generate a CSRF exploit form with configurable parameters. CSRF-exploit-generator Features Input Target URL : Specifies the URL to be exploited. Input POST Parameters : Allows adding POST parameters to be sent via the CSRF request...
EUVD-2026-102517
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...