HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. Description The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion...

toxssin

toxssin Назначение toxssin — это инструмент тестирования на проникновение с открытым исходным кодом, который автоматизирует процесс эксплуатации уязвимостей межсайтового скриптинга XSS. Он состоит из HTTPS-сервера, который работает как интерпретатор трафика, генерируемого вредоносной...

JS-Tap

JS-Tap v3.0.4 Этот инструмент предназначен для использования только на системах, которые вам разрешено атаковать, а также для законных и образовательных целей. Не используйте этот инструмент в незаконных целях, иначе я буду очень зол в вашем направлении. Журнал изменений Основные изменения...

mqxss

mqxss v0.2 mqxssはMQTTを介してフックされたブラウザと通信するクライアントとして動作します beefやxsshunterよりもこれを使う利点は、jsペイロードをホストする以外にインフラのセットアップが不要なことです。パブリックブローカーを使用できます（ただし、現在は難読化を使用しており、暗号化は開発中です）。 フックされたブラウザは、指定したブローカーのMQTTトピックで通信します。これをテストするためのパブリック/フリーブローカーが多数あります。...

CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Автор: Byte Reaper Описание: Этот репозиторий содержит доказательство концепции PoC и простой эксплойт для CVE-2025-54589 , отражённой межсайтовой уязвимости XSS в Copyparty ≤ 1.18.6. С помощью внедрения специально созданных JavaScript-нагрузок в параметр...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

poc_CVE-2025-68613

PoC: n8n 샌드박스 이스케이프 CVE-2025-68613 교육 목적 전용 이 PoC는 n8n의 심각한 취약점CVE-2025-68613을 시연합니다. 소유하지 않은 시스템이나 명시적인 테스트 허가를 받지 않은 시스템에서는 사용하지 마십시오. 취약점 개요 1.122.0 이전 버전의 n8n에는 원격 코드 실행RCE 취약점이 존재합니다. 인증된 사용자는 워크플로 표현식 편집기의 특정 JavaScript 페이로드를 통해 표현식 샌드박스를 우회하고 호스트 시스템에서 임의 코드를 실행할 수 있습니다. 1. 취약한 환경 설정 데이터...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16-h2 / 11.2.x < 11.2.13-h2 / 12.1.x < 12.1.10 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16-h2, 11.2.x prior to 11.2.13-h2, or 12.1.x prior to 12.1.10. It is, therefore, affected by a vulnerability. A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a...

CVE-2017-1000486

CVE-2017-1000486 Эксплойт Proof of Concept для PrimeFaces 5.x EL Injection CVE-2017-1000486, уязвимость RCE, которая может быть использована для удаленного выполнения кода на цели. Описание уязвимости Вы можете найти отличное описание уязвимости в блоге Minded Security. Использование Эксплойт...

Project-CVE-2026-65351

BROWSER BOMB / 리소스 고갈 페이로드 Xer0TLabs & Persephrak Decentralized Syndicate가 개발한 스트레스 테스트용 브라우저 스크립트에 대한 분석 및 문서 개요입니다. 경고: 교육, 연구 및 승인된 테스트 목적으로만 사용하십시오. 이 스크립트를 실행하면 대상 브라우저 탭, 애플리케이션 또는 운영 체제가 즉시 멈추거나 충돌합니다. 1. 프로젝트 개요 이 저장소에는 최신 웹 브라우저 내에서 하드웨어 및 소프트웨어 병목 현상을 동시에 유발하도록 설계된 포괄적인 브라우저 충돌 유틸리티가...

CVE-2025-52385

CVE-2025-52385 Программное обеспечение : Studio 3T v.2025.1.0 Отчёт об уязвимости : Удалённое выполнение команд в Studio 3T Обзор Критическая уязвимость в Studio 3T версии 2025.1.0 и более ранних позволяет удалённому злоумышленнику выполнять произвольный код с помощью специально созданной нагрузк...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

CVE-2026-15386

The CVE affects the Meow Gallery WordPress plugin (vulnerable in versions before 5.5.2). The flaw is that the plugin does not escape an attachment’s alt text when it injects it into the URL/link attributes of linked galleries, enabling stored XSS. Attackers with the Author role or higher can stor...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

EUVD-2026-52701

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

CVE-2026-69251

Flowise prior to version 3.1.3 is affected by a RCE in the TypeORM DataSource configuration via the additionalConfig input on specific nodes (record managers and agent memory nodes for MySQL, Postgres, SQLite, and MySQL/AgentMemory). The issue allows an authenticated user to inject arbitrary Java...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-13605

The vulnerability CVE-2026-13605 affects the PhotoSwipe WordPress plugin up to version 4.1.1.1. The root cause is that the plugin uses the title attribute from author-provided link markup as a lightbox caption and writes it into the DOM without escaping. Because the title survives post-content sa...

CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...