CVE-2025-27897

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to a cross-site scripting (XSS) flaw (CWE-79). This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code into the Web UI , which can alter the application's functionality and potentially lead...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

CVE-2024-4367-hands-on-01

!IMPORTANT This repository is for learning about vulnerabilities. Perform this hands-on only on an appropriate computer that you manage. Never engage in illegal activities. The author accepts no responsibility or liability for any damage arising from this repository. CVE-2024-4367-hands-on A...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "email" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor ca...

CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles in the Extensions - MicroTiny WYSIWYG editor. Attack Vectors: Scripting A vulnerability ...

CVE-2025-1015

CVE-2025-1015: The Thunderbird Address Book contains unsanitized URI fields that could be exploited by attackers. By creating an address book with malicious links, an attacker may trick another user into importing the compromised address book. If the user clicks on the unsanitized link within...

metabase-cve-2023-38646

cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Metabase Pre-Auth Remote Code Execution Summary CVSS 9.8. Metabase versions before 0.46.6.1 / 1.46.6.1 and equivalent earlier branches expose a pre-authentication RCE via the /api/setup/validate endpoint, which is meant to validate database...

CVE-2026-27495

CVE-2026-27495 — n8n JS Task Runner Sandbox Escape Sandbox escape on n8n JavaScript Task Runner via host-realm object leak. | ---|--- CVE| CVE-2026-27495 CVSS| 9.4 Critical CWE| CWE-94 — Code Injection Affected| n8n 1.123.22 / 2.0.0–2.9.2 / 2.10.0 Fixed| 1.123.22 / 2.9.3 / 2.10.1 Attack Surface|...

CVE-2026-85965

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability...

CVE-2026-109338

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get, entries, values, or getSetCookie, or return them...

CVE-2026-109288

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. Legal Disclaimer & Responsible Use This tool is provided for...

CVE-2026-85965 Use-after-free in Progress MarkLogic Server JavaScript engine integration

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability...

CVE-2026-85965

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by a Use-after-free memory-safety defect within the JavaScript engine integration . This vulnerability could lead to memory corruption , controlled process failure , or server instability . No specific explo...

EUVD-2026-97557

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Attack Vectors: Scripting A vulnerability in the sanitization of t...

EUVD-2026-97640

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get, entries, values, or getSetCookie, or return them...

CVE-2026-109338

SurrealDB versions prior to 3.3.0 are vulnerable to a Denial of Service (DoS) flaw. The issue stems from the handling of non-ASCII header values within embedded JavaScript . Query-capable users with scripting enabled can trigger a server crash by accessing these values through functions such as H...