CVE-2024-41503

CVE-2024-41503 CVE: CVE-2024-41503 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Vulnerability: Stored Cross-Site Scripting XSS Description: The "Busca" search function used throughout the application contains a filter option that can be saved - when saving it, there is...

Injection-vulnerability-in-Paradox-Security-Systems-IPR512-CVE-2023-24709-PoC

Injection vulnerability in Paradox Security Systems IPR512 - CVE-2023-24709 PoC In Paradox Security System IPR512 Web console login form page, attacker can input JavaScript string, such as that will overwrite configurations in the file "login.xml" and cause the login form to crash and make it...

CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles in the Extensions - MicroTiny WYSIWYG editor. Attack Vectors: Scripting A vulnerability ...

metabase-cve-2023-38646

cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Metabase Pre-Auth Remote Code Execution Summary CVSS 9.8. Metabase versions before 0.46.6.1 / 1.46.6.1 and equivalent earlier branches expose a pre-authentication RCE via the /api/setup/validate endpoint, which is meant to validate database...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier 🔥 ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Attack Vectors: Scripting A vulnerability in the sanitization of t...

CVE-2023-44765_ConcreteCMS-Stored-XSS---Associations

ConcreteCMS XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

CVE-2024-48326

CVE-2024-48326 Description: Portabilis i-Educar v2.8.0 is vulnerable to Cross-Site Scripting XSS via the nmreligiao parameter in POST request at /intranet/educarreligiaocad.php and trigged in GET request at /intranet/educarreligiaolst.php?busca=S&nmreligiao=. This allows an unauthenticated remote...

CVE-2023-31703

CVE-2023-31703 — Reflected XSS in eScan Management Console Overview CVE ID: CVE-2023-31703 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium Discovered By: Sahil Ojha Disclosu...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script This PoC script exploits CVE-2024-39090, a CSRF to Stored XSS vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates CSRF attacks to inject persistent JavaScript payloads, which execute when a privileged user accesses the affected page, enabling...

CVE-2023-44771_ZenarioCMS--Stored-XSS---Page-Layout

ZenarioCMS Stored XSS v.9.4.59197 Author: Sergio Description: Cross Site Scripting vulnerability in ZenarioCMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. Attack Vectors: Scripting a vulnerability in the sanitization of the entry in the...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Extra in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

CVE-2023-44762_ConcreteCMS-Reflected-XSS---Tags

ConcreteCMS Reflected XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags. Attack Vectors: Scripting a vulnerability in the sanitization of the ent...

audit-xss-cve-2020-7934

CVE 2020-7934 How to run CVE Requirements 1. docker Remarks it's possible put the script attack online given the js code http://yourjavascript.com/ Our Js script online for the attack html Commands for configuration 1. go to root folder of this project 2. run "sudo docker-compose up --build" 3. n...

Malicious code in godsplan (npm)

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port 9222 and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text a...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "firstname" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious acto...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS Stored XSS v2.3.2 Author: Sergio Description: Multiple Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. Attack Vectors: Scripting A...

CVE-2023-43873-e107-CMS-Stored-XSS---Manage

e107 CMS Stored XSS v2.3.2 Author: Sergio Description: Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu. Attack Vectors: Scripting A vulnerability in the sanitization of the entry...

CVE-2025-63498

Stored XSS in cookie Alinto/SOGo Researchers: Daniil Khomichenok, Alexander Klimenko Affected Versions var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Code of login remember set-cookie which accepts XSS injections as a paramteter value: if...