Lucene search
+L

859 matches found

Kitploit
Kitploit
added 2026/09/03 12:21 a.m.7 views

MDaemon-Advisories

MDaemon-Advisories MDaemon Advisories: CVE-2021-27180 Reflected XSS CVE-2021-27181 CSRF Token Fixation CVE-2021-27182 Iframe injection CVE-2021-27183 Remote Code Execution Those vulnerabilities were already patched on January 2021 and are published for CVE purposes. They can be chained to achieve...

8.8CVSS6.8AI score0.02695EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/02 6:35 a.m.3 views

dns-rebind-toolkit

DNS Rebind Toolkit Демо | Уведомление о безопасности | Встроенные полезные нагрузки | FAQ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ: Данное программное обеспечение предназначено только для образовательных целей. Оно не должно использоваться для незаконной деятельности. Автор не несет ответственности за его...

5.8AI score
SaveExploits0References9
Kitploit
Kitploit
added 2026/08/29 1:33 p.m.4 views

CVE-2012-2593

Atmail - Catena di Exploit XSS-CSRF-RCE PoC atmail-rce.py: Sfrutta CVE-2012-2593 nell'interfaccia webmail di Atmail. atmail-csrf.js: File Javascript che sfrutta CVE-2012-2593 per effettuare un CSRF al fine di installare un plugin malevolo che esegue una reverse shell Plugin.php: Plugin di Atmail ...

6.1CVSS6.8AI score0.06229EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/08/28 12:00 p.m.5 views

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 POC SSRF di Pandoc Una Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 consente agli attaccanti di ottenere accesso e compromettere l'intera infrastruttura tramite l'iniezione di un iframe modificato. Installazione di Pandoc https://pandoc.org/installing.html Esempio di Paylo...

3.7CVSS6.7AI score0.00609EPSS
SaveExploits1
NVD
NVD
added 2026/08/21 4:18 a.m.11 views

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.2CVSS0.00231EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/30 8:54 a.m.10 views

CVE-2026-6954

Cross-Site Scripting XSS vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dynamic iframe into the victim’s browser by sending a malicious URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can be...

5.1CVSS5.9AI score0.00436EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/27 5:31 a.m.18 views

EUVD-2026-32081

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within th...

6.4CVSS6AI score0.00187EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/05/27 5:31 a.m.49 views

CVE-2026-8845 Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within th...

6.4CVSS0.00187EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/05/27 12:00 a.m.28 views

PT-2026-43510

The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' and 'button' shortcode attributes in the rspc check shortcod...

6.4CVSS6AI score0.00204EPSS
SaveExploits0References6
NVD
NVD
added 2026/04/08 3:16 p.m.9 views

CVE-2026-39390

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting cMap field in compInfosPost sanitizes input using striptags with an allowlist and regex-based removal of...

5.5CVSS0.00235EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/03/20 11:25 p.m.6 views

CVE-2026-3516

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clmapiframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFiel...

6.4CVSS6AI score0.00272EPSS
SaveExploits1References9
CNNVD
CNNVD
added 2026/03/16 12:00 a.m.18 views

RealtyScript 跨站脚本漏洞

RealtyScript is a real estate website management system developed by RealtyScript Corporation. Version 4.0.2 of RealtyScript contains a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of text parameters, which may allow attackers to inject malicious HTML and...

6.4CVSS5.7AI score0.00207EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
added 2026/02/28 7:45 p.m.19 views

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS6.1AI score0.00322EPSS
SaveExploits0References1
NVD
NVD
added 2026/02/27 3:16 p.m.20 views

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS0.00322EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/02/27 2:09 p.m.8 views

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS6.1AI score0.00322EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/02/27 2:09 p.m.36 views

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS0.00322EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/02/27 2:09 p.m.9 views

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS6.1AI score0.00322EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/02/27 2:09 p.m.29 views

CVE-2026-3327

This CVE concerns the DatoCMS Web Previews plugin, where an authenticated user can perform an iframe injection by bypassing the frontend URL restriction. The root cause is an insecure handling of embedded resources in the Web Previews feature, affecting versions earlier than 1.0.31. Impact is the...

4.8CVSS6.1AI score0.00322EPSS
SaveExploits0References1
OSV
OSV
added 2026/02/27 2:09 p.m.8 views

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS6.1AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/02/27 12:00 a.m.21 views

PT-2026-22341

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

4.8CVSS6.1AI score0.00322EPSS
SaveExploits0References2
Rows per page
Query Builder