CVE-2023-4294

CVE ID : CVE-2023-4294 Vulnerability Type : Cross-Site Scripting Description : The URL Shortify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the referrer header in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'page' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal. Summa...

CVE-2021-38602

CVE-2021-38602 A stored cross site scripting vulnerability is present on the Article editing page in version 5.8.7 of PluXML. User input is not properly sanitized in multiple fields. Vulnerable Fields: Headline optional: Content: Once inserted, XSS can be triggered by visiting the posted article ...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

CVE-2024-55270

Student Management System 1.0 CVE-2024-55270 Overview The Student Management System SMS is a web application developed using PHP and MySQL for managing student information. This repository contains the source code and details of the system, along with a security vulnerability report. Auditor:...

CVE-2022-27251

CVE-2022-27251 Remote Code Execution in LocalStack 0.12.6 Due to the lack of sanitization on user input on the Lambda API handler field whilst spawning Lambda functions and the way Docker containers are insecurely spawned, an injection can be provided through AWS CLI in the --handler option to be...

EUVD-2026-125940

The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name array key' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2025-9816

CVE-2025-9816 Stored XSS On WP-Statistics Plugin Scanner Detection & PoC "The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to...

CVE-2025-68723

CVE-2025-68723: Axigen WebAdmin Stored XSS Vulnerability Summary Multiple input fields within the Axigen WebAdmin interface lack proper sanitization, allowing for the execution of malicious JavaScript. These vulnerabilities enable a low-privileged administrator or an attacker leveraging Broken...

CVE-2024-41453_CVE-2024-41454

CVE-2024-41453 CVE-2024-41454 ProcessMaker Vulnerabilites just for education: @ryancooley @velkymx @nolanpro @caleeli install ProcessMaker 4 Core Docker Instance frome this repository: https://github.com/ProcessMaker/pm4core-docker this is latest pm docker version PMVERSION=4.1.21, below image is...

CVE-2025-56771

Description During analysis of the ecodotempo.com.br website, a Stored Cross-Site Scripting XSS vulnerability was discovered. This vulnerability allows an attacker to inject malicious scripts into fields that are subsequently rendered to other users without proper sanitization, specifically on th...

CVE-2023-4549

CVE ID : CVE-2023-4549 Vulnerability Type : Cross-Site Scripting Description : The DoLogin Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping...

CVE-2024-9441

CVE-2024-9441 Description of the Vulnerability: This code exploits a Remote Code Execution RCE vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality index.php?c=user&m=forgotpassword, where user...

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...