CVE-2025-56795

CVE-2025-56795 Description Two stored Cross-Site Scripting XSS vulnerabilities were identified in the recipe creation functionality of Mealie , affecting all versions up to and including 3.0.1. Unsanitized user input provided during recipe creation is stored and later rendered in the frontend...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Perfex CRM 챗봇의 저장형 크로스사이트 스크립팅XSS ⚠️ 보안 권고 Perfex CRM 챗봇 기능에서 발견된 심각한 저장형 크로스사이트 스크립팅 취약점 📋 개요 Perfex CRM 3.3.1 이전 버전의 챗봇 구성 요소에서 발견된 저장형 XSS크로스사이트 스크립팅 취약점으로, 공격자가 채팅 메시지를 통해 임의의 JavaScript 코드를 주입할 수 있습니다. 악성 페이로드는 애플리케이션 데이터베이스에 저장되며, 채팅 대화를 보는 사용자의 브라우저에서 실행되어 세션...

detect-cve-2024-4367

CVE-2024-4367 탐지 PDF.js에서 임의 JavaScript 실행을 허용하는 CVE-2024-4367에 대한 빠르고 간단한 YARA 탐지 규칙입니다. 사용법 $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf 크레딧 PoC 및 공개 정보:...

CVE-2026-105090

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

Adobe ColdFusion - Cross-Site Scripting

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

Adobe Coldfusion - Cross-Site Scripting

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within th...

CVE-2026-105090

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

EUVD-2026-91874

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

CVE-2018-14667

CVE-2018-14667 상세:https://xz.aliyun.com/t/3264 poc calcwindows：...

EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...

GHSA-72QQ-P3R5-F7WQ @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

windbg_js_scripts

WinDbg JavaScript 스크립트 WinDbg 갤러리로 설치 저장소를 클론하세요 git clone https://github.com/hugsy/windbgjsscripts windbgjsscripts\config.xml에서 Setting Name="LocalCacheRootFolder" 줄을 편집하여 저장소의 로컬 경로를 반영하세요. WinDbg에서 config.xml 파일을 로드하고 설정을 저장하세요: windbg .settings load \path\to\windbgjsscripts\config.xml...

browser-pwn

Browser-Pwn 브라우저 세계는 4개의 주요 플레이어가 지배하고 있습니다: Chromium/Chrome Blink 엔진 Firefox Gecko 엔진 Safari WebKit 엔진 Edge Blink 엔진 구 EdgeHTML 엔진 다음 내용은 두 부분으로 나뉩니다: 아키텍처와 구현을 이해하고 소스에서 빌드하는 데 도움이 되는 정보 계산기 실행 기능을 찾는 데 도움이 되는 정보 목차 1. 엔진 개요 Chromium Firefox Safari Edge 2. 익스플로잇 개요 Chromium Firefox Safari Edge ...

weaponised-XSS-payloads

무기화된 XSS 페이로드 alert1을 P1으로 바꾸도록 설계된 XSS 페이로드 블로그 게시물 이 저장소는 "How to Upgrade Your XSS Bugs from Medium to Critical"이라는 제목의 블로그 게시물과 함께 공개되었습니다. https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4 이게 뭔가요? 이 저장소에는 인기 있는 CMS 플랫폼에서 피해자 브라우저의 컨텍스트로 민감한 기능을 수행하기 위해 XSS 페이로드에 로드할...

CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose,...

CVE-2026-104872

Several OpenTelemetry JavaScript Contrib instrumentation libraries versions are vulnerable to the inclusion of sensitive information. Specifically, versions prior to 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, 하지만 wasm을 사용한 상태: 검증된 크래시 PoC, 제어 흐름 하이재킹 시연 완료 디버그 셸에서 크래시pc = 해제된 셀 포이즌 0xcdcdcdcdcdcdcdcd — 엔진이 해제된 ICScript에서 읽어낸 포인터로 점프함. 남은 작업: 재점유된 바이트를 제어하는 것. research/README.md 참조. 2026년 버그에 대한 WasmBlazeFox 계열 체인: CVE-2026-2766, "JavaScript Engine의 JIT 오컴파일 / use-after-free: JIT 컴포넌트",...