CVE-2021-43032

CVE-2021-43032 In XenForo ≤ 2.2.7, a threat actor with access to the admin panel can save cross-site scripting payloads in any function within the application that accepts HTML code. A payload placed within the 'Advertising' functionality will execute globally on the client side, allowing for...

Bootstrap-with-XSS

Bootstrap Historical Vulnerability PoC Collection This is a static HTML page for learning and research, which integrates multiple Proof of Concept PoC exploits for Cross-Site Scripting XSS vulnerabilities in the historical versions of the Bootstrap framework. This project aims to provide security...

CVE-2024-5737

CVE-2024-5737 AdmirorFrames Joomla! Extension HTML tag: $height=0x3c; $im = imagecreate$width, $height; $hex=unpack'H',$payload; $chunks=strsplit$hex1, 6; for$i=0; $i count$chunks; $i++ $colorchunks=strsplit$chunks$i, 2;...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09 Technical Summary Out...

CVE-2026-64638

CVE-2026-64638 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2026-111932

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932

The Coder platform versions before 2.29.17 , 2.30.0 (before 2.32.7 ), 2.33.0 (before 2.33.8 ), and 2.34.0 (before 2.34.2 ) are vulnerable to a stored HTML injection vulnerability. The root cause is the insufficient escaping of ApplicationName and LogoURL appearance settings when rendered into HTM...

EUVD-2026-103299

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

EUVD-2026-103325

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894

The software phpMyFAQ (versions 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure in the FaqHelper::cleanUpContent() function, which allows authenticated content authors to bypass the hostless media-host al...

CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

Instatic-Stored-XSS-CVE-2026-103931

URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...

CVE-2026-100381

CVE-2026-100381: DOM XSS in Flickr collection and set titles Reporter: Marco Paciaroni BomboBombone. UploadWizard inserted Flickr collection and set titles through an API that interpreted strings as HTML. External title metadata could therefore become executable markup in the wiki page. Affected...

CVE-2025-26633

CVE-2025-26633 - MSC EvilTwin PoC Proof of Concept PoC for CVE-2025-26633 vulnerability exploiting Microsoft Management Console MMC About This PoC simulates the CVE-2025-26633 vulnerability, discovered by Trend Micro, which exploits the loading of malicious .msc files for remote command execution...

CVE-2026-11645-Out-of-bounds-Read-Write

CVE-2026-11645 - Chrome V8 Out-of-Bounds Read/Write Exploit ⚠️ WARNING This code is ONLY for educational purposes and authorized testing. 📋 Description CVE-2026-11645 is an out-of-bounds read and write OOB vulnerability in the V8 engine of Google Chrome. A remote attacker can execute arbitrary cod...

wwwgrep

WWWGrep OWASP Foundation Web Respository Author: Mark Deen & Aditi Mohan Introduction WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed...

CVE-2026-111932: Improper Neutralization of Input During Web Page Generation

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...