CVE-2024-4367-POC

CVE-2024-4367 Preuve de concept Utilisation python poc.py malicious.pdf "alert'S4vvy'" Références CVE-2024-4367 : Exécution arbitraire de JS dans PDF.js PDF.js...

CVE-2026-54433

CVE-2026-54433: Roundcube 일반 텍스트 이메일 저장형 XSS 이 저장소에는 CVE-2026-54433 , 즉 Roundcube의 일반 텍스트 이메일 렌더러에 존재하는 저장형 크로스 사이트 스크립팅 취약점에 대한 구성 가능한 Python 개념 증명PoC이 포함되어 있습니다. 인증되지 않은 발신자는 조작된 text/plain 메시지를 전달할 수 있습니다. 인증된 Roundcube 사용자가 해당 메시지를 열거나 미리 보면 공격자가 제어하는 JavaScript가 Roundcube 출처에서 실행됩니다. 이 PoC는...

CVE-2024-6529

Preuve de Concept PoC pour les vulnérabilités dans les plugins WordPress Ce dépôt contient des scripts de Preuve de Concept PoC pour diverses vulnérabilités découvertes dans différents plugins WordPress. Ces scripts montrent comment les attaquants peuvent exploiter ces vulnérabilités pour effectu...

CVE-2024-50849

CVE-2024-50849 : XSS stocké dans WorldServer v11.8.2 Une vulnérabilité de Cross-Site Scripting XSS stocké dans la fonctionnalité "Rules" de WorldServer v11.8.2 permet à un attaquant distant authentifié d'exécuter du code JavaScript arbitraire. Un utilisateur authentifié disposant de privilèges...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367 : Exécution arbitraire de JavaScript dans PDF.js Ce projet démontre et analyse CVE-2024-4367 , une vulnérabilité de haute sévérité dans la bibliothèque PDF.js de Mozilla qui permet l'exécution arbitraire de JavaScript via une vérification de type incorrecte dans le code de gestion...

CVE-2023-46948

CVE-2023-46948 - XSS Réfléchi dans Temenos T24 R19.40 Une vulnérabilité de Cross-Site Scripting XSS réfléchi a été découverte dans Temenos T24 Browser R19.40, permettant à un attaquant distant d'exécuter du code JavaScript arbitraire dans la console web basée sur le navigateur d'une victime...

CVE-2020-13965

CVE-2020-13965: Межсайтовый скриптинг XSS через вредоносное XML-вложение в Roundcube Webmail Уязвимость межсайтового скриптинга XSS существует в версиях Roundcube до 1.4.5 и 1.3.12. Используя разбор вложения "text/xml", злоумышленник может обойти фильтр скриптов Roundcube и выполнить произвольный...

Cross-site Scripting (XSS)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the add and update methods of the Certificates API, which parse SSL certificates and store the issuer organization value without sanitization. An attacker...

CVE-2026-100639

SiYuan v3.8.3 is vulnerable to a Cross-Site Scripting (XSS) flaw due to a failure to HTML-escape the data-subtype attribute during gutter-button markup generation. This occurs when content containing a Kramdown inline attribute list (IAL) is pasted as plain-text Markdown. The shared Lute renderer...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-100521

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

EUVD-2026-87377

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100522

Versions of Cotonti through 1.0.0 are vulnerable to a reflected cross-site scripting (XSS) flaw in the message.php file. The root cause is the improper escaping of the lng parameter before it is displayed in the confirmation dialog. This allows unauthenticated attackers to craft malicious links c...

CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100174

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174

The AIL Framework tag selector component (specifically var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of input sanitization for tag names; the application passes the displayField value directly to the jQuery .html() property in both the ...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

BIT-GRAFANA-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...