JS-Tap

JS-Tap v3.0.4 Esta herramienta está diseñada para ser utilizada en sistemas que estás autorizado a atacar y con fines legales y educativos. No uses esta herramienta para fines ilegales, o me enojaré mucho contigo. Registro de cambios Los cambios importantes se documentan en los Anuncios del...

toxssin

toxssin Propósito toxssin es una herramienta de pruebas de penetración de código abierto que automatiza el proceso de explotación de vulnerabilidades de Cross-Site Scripting XSS. Consiste en un servidor https que actúa como intérprete del tráfico generado por el payload malicioso de JavaScript qu...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - Generador de payloads JS para evasión de IDS y entrega de payloads mediante contrabando HTML. Descripción La explicación completa de qué es el contrabando HTML se puede encontrar aquí. El objetivo principal del contrabando HTML es eludir los controles de seguridad de...

mqxss

mqxss v0.2 mqxss actúa como un cliente para comunicarse con navegadores enganchados a través de MQTT La ventaja de usar esto en lugar de beef o xsshunter es que, además de alojar el payload js, no hay configuración de infraestructura; puedes usar un broker público aunque actualmente usa ofuscació...

CVE-2017-1000486

CVE-2017-1000486 Explotación de prueba de concepto para la inyección EL de PrimeFaces 5.x CVE-2017-1000486, una vulnerabilidad RCE que puede usarse para obtener ejecución remota de código en un objetivo. Descripción de la vulnerabilidad Puede encontrar una excelente descripción de la vulnerabilid...

Project-CVE-2026-65351

BROWSER BOMB / RESOURCE EXHAUSTION PAYLOAD An analysis and documentation overview of the stress-testing browser script developed by Xer0TLabs & Persephrak Decentralized Syndicate. WARNING: For educational, research, and authorized testing purposes only. Running this script will immediately freeze...

CVE-2025-52385

CVE-2025-52385 Software : Studio 3T v.2025.1.0 Informe de vulnerabilidad : Ejecución remota de comandos en Studio 3T Descripción general Una vulnerabilidad crítica en Studio 3T versión 2025.1.0 y anteriores permite que un atacante remoto ejecute código arbitrario a través de una carga útil...

Malicious code in @angularr/router (npm)

@angularr/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

CVE-2025-54589

CVE-2025-54589 – XSS Reflejado en Copyparty Autor: Byte Reaper Descripción : Este repositorio proporciona una Prueba de Concepto PoC y una explotación simple para CVE-2025-54589 , una vulnerabilidad de Cross-Site Scripting XSS reflejado en Copyparty ≤ 1.18.6. Al inyectar payloads de JavaScript...

poc_CVE-2025-68613

PoC: Escape del Sandbox de n8n CVE-2025-68613 Solo con Fines Educativos Esta Prueba de Concepto demuestra una vulnerabilidad crítica CVE-2025-68613 en n8n. No la utilices en sistemas que no te pertenezcan o para los cuales no tengas permiso explícito de prueba. Resumen de la Vulnerabilidad Las...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

PSAITO

PSAITO PS5 WebKit userland entry point with an integrated pay...

Palo Alto Networks PAN-OS 10.0.x / 10.2.x / 11.0.x / 8.1.x / 9.0.x / 9.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 8.1.x, 9.0.x, 9.1.x, 10.0.x, 10.2.x, or 11.0.x. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious...

CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16-h2 / 11.2.x < 11.2.13-h2 / 12.1.x < 12.1.10 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16-h2, 11.2.x prior to 11.2.13-h2, or 12.1.x prior to 12.1.10. It is, therefore, affected by a vulnerability. A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a...

CVE-2026-85593: Improper Neutralization of Input During Web Page Generation

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-15386

The Meow Gallery WordPress plugin versions before 5.5.2 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape an attachment's alt text before it is output into an attribute of a link built for linked galleries. This allows users with the Author role or highe...