CVE-2023-31853

CVE-2023-31853 Cudy LT400의 웹 기반 관리 인터페이스에 반사형 크로스 사이트 스크립팅XSS 공격이 존재합니다. /cgi-bin/luci/admin/network/bandwidth 페이지에서 icon 파라미터를 통해 반사형 XSS가 발생합니다. 공격 방법은 피해자에게 악성 코드가 포함된 특수하게 조작된 요청을 보내는 것입니다. 영향을 받는 애플리케이션은 세션 쿠키에 HttpOnly 속성을 설정하지 않으며, 이로 인해 세션 토큰 도난을 통해 관리자 계정을 탈취할 수 있습니다. PoC GET...

HeimShell

HeimShell CVE-2023-51803 HeimShell 은 CVE-2023-51803에 대한 익스플로잇으로, LinuxServer.io Heimdall≤ 2.5.6의 임의 파일 업로드 취약점을 활용합니다. 대상 버전을 자동으로 감지하여 익스플로잇 가능 여부를 경고하거나 SHELLURL로 정의된 PHP 셸을 원격으로 가져옵니다. ≤ 2.2.2 : 임의 파일 업로드가 가능하지만 파일은 정적으로 제공되며 URL은 원격으로 가져오지 않습니다. ≥ 2.2.3 & ≤ 2.5.6: 아이콘 URL 업로드를 통해 PHP 셸을 원격으로...

CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

EUVD-2026-18991

The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfoptinform' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of th...

PT-2026-30343

The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf optin form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of...

CVE-2025-12518

beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all...

CVE-2025-12518 Stored XSS in beefree.io

beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all...

EUVD-2016-1582

Malware in sbrugna...

EUVD-2023-36143

Malicious code in bioql PyPI...

CVE-2023-31853

Cudy LT400 1.13.4 is vulnerable Cross Site Scripting XSS in /cgi-bin/luci/admin/network/bandwidth via the icon parameter...

UBUNTU-CVE-2025-32807

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png and .svg or .xpm for some configurations via the icon parameter of a GET request to geticon.php...

CVE-2025-32807: Path Traversal: '../filedir'

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png and .svg or .xpm for some configurations via the icon parameter of a GET request to geticon.php...

PT-2025-16015 · Unknown +1 · Fusiondirectory +1

Name of the Vulnerable Software and Affected Versions: FusionDirectory versions prior to 1.5 Description: A path traversal vulnerability in FusionDirectory allows remote attackers to read arbitrary files on the host that end with .png and .svg or .xpm for some configurations via the icon paramete...

CVE-2025-1291: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-1076: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

WordPress Plugin Essential Addons for Elementor Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-4497 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Icon parameter. The XSS is loaded from /users.ghp...

Chat Server Cross-Site Scripting Vulnerability

Chat Server is ramank775 individual developer's chat server based on microservices architecture, supporting high availability, high throughput, horizontal scaling. A cross-site scripting vulnerability exists in Chat Server version 3.1, which stems from a stored cross-site scripting XSS...

CVE-2023-4497: Improper Neutralization of Input During Web Page Generation

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Icon parameter. The XSS is loaded from /users.ghp...

PT-2023-29324 · Unknown · Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Easy Chat Server versions 3.1 and earlier Description: The issue arises from insufficient encryption of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is stored via the "/registresult.htm" API...