SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...

CVE-2026-86536 Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript

Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue...

CVE-2025-58434-59528-htb-ctf

CVE-2025-58434-59528-htb-ctf Silentium Exploit Chain This repository contains the complete exploitation chain for the Silentium machine on Hack The Box. The exploit leverages a two-stage vulnerability involving user enumeration and JavaScript injection to achieve Remote Code Execution RCE. 📝...

CVE-2018-25031

Swagger UI Cross-Site Scripting POC: CVE-2018-25031 using Selenium in Python This repository contains a Python script that demonstrates a proof of concept POC of a Cross-Site Scripting XSS vulnerability in Swagger UI, using the Selenium library. The goal of this POC is to identify websites that a...

CVE-2022-35499

In Trimble TM4WEB =22.2.0 the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL. Step 1 : The following example URL will trigger the vulnerability and execute the javascript alert function displaying the number...

jsluicepp

📄 Table of Contents 👋 Introduction 🛠️ Setup 📝 Usage 📜 Features Monitor URLs Send to Repeater Secrets Secret Notifications Copy URL Positive/Negative Match In-scope only In-line Tags Hide Duplicates Show Parameterized Import/Export Save Settings 🤝 Contributors 👋 Introduction jsluice++ is a Burp...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

MAL-011

MAL-011: Log4J Misconfiguration Allows Malicious JavaScript in Red Hat AMQ The Log4J component of the Redhat A-MQ application is misconfigured to allow the execution of arbitrary “Script” attributes in the Log4J config. If an attacker finds a way to modify the Log4J config used by A-MQ e.g. via...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script Program Code Python generating malicious PDF generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf print"malicious.pdf create...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Reflected Cross-Site Scripting XSS Table of Contents Overview Vulnerability Details Affected Product Technical Analysis Proof of Concept Steps to Reproduce Impact Mitigation & Remediation References Disclaimer Overview A Reflected Cross-Site Scripting XS...

avscript

Intérprete de JavaScript de Avast Antivirus NOTA: El 03/11/2020 Avast anunció que había decidido deshabilitar este intérprete a nivel mundial. El proceso principal de Avast Antivirus se llama AvastSvc.exe, que se ejecuta como SYSTEM. Ese servicio carga el motor antivirus de bajo nivel y analiza...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

jsprime

Autores Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introducción Hoy en día, cada vez más desarrolladores están optando por JavaScript como su lenguaje de elección. La razón es simple: JavaScript ha empezado a ser aceptado como la programación convencional para...

InfoLeak-Scanner

InfoLeak-Scanner Docker Primero ejecuta docker run --rm -p 8000:80 siwecos/infoleak-scanner. Abre tu navegador y usa el escáner: http://localhost/?url= Instalación Obtén php5, curl y un servidor web: sudo apt-get install apache2 php5 php5-curl Copia la aplicación al servidor web: cp -R...

CVE-2026-93367

The Visitors Traffic Real Time Statistics Pro plugin for WordPress (versions up to and including 11.22 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization on the page_title parameter within the ahcpro_track_visitor AJAX action, which i...

VUL4J-60

antisamy 신뢰할 수 없는 출처에서 온 HTML을 빠르고 설정 가능하게 정화하는 라이브러리입니다. 다르게 말하자면, 클라이언트가 프로필, 댓글 등에 제공하는 HTML에 악성 화물 코드를 포함하지 않도록 서버에서 보장하는 API라고 할 수 있습니다. 웹 애플리케이션에서 "악성 코드"는 일반적으로 "JavaScript"를 의미합니다. 대부분의 경우, 캐스케이딩 스타일 시트Cascading Stylesheets는 JavaScript를 호출할 때만 악성으로 간주됩니다. 그러나 "정상적인" HTML과 CSS도 악의적인 방식으로 사...

Garbage-collection-in-v8

This repository does not have a README...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: 반사형 교차 사이트 스크립팅 XSS 개요 CVE-2023-34837 은 Microworld Technologies eScan Management Console 버전 14.0.1400.2281에서 발견된 반사형 교차 사이트 스크립팅Reflected Cross-Site Scripting, XSS 취약점입니다. 이 취약점은 Unmanaged Computers → Network Computers 기능의 GrpPath POST 매개변수에 존재합니다. 사용자가...