PT-2026-104403

Name of the Vulnerable Software and Affected Versions Tinypool versions prior to 2.1.2 Description Tinypool reads the filename from a caller-supplied options object in the pool.runtask, options function without verifying if the property is an own property of the object. This allows a polluted...

CVE-2025-7840

Exploit XSS para CVE-2025-7840 Autor : Byte Reaper @ByteReaper0 Descripción Exploit de prueba de concepto para CVE-2025-7840 , dirigido a un endpoint de aplicación web vulnerable que no sanitiza la entrada del usuario en el parámetro Firstname de un formulario de reserva. Al construir una solicit...

CVE-2025-54589

CVE-2025-54589 – XSS Reflejado en Copyparty Autor: Byte Reaper Descripción : Este repositorio proporciona una Prueba de Concepto PoC y una explotación simple para CVE-2025-54589 , una vulnerabilidad de Cross-Site Scripting XSS reflejado en Copyparty ≤ 1.18.6. Al inyectar payloads de JavaScript...

CVE-2023-34836

CVE-2023-34836 — eScan Management Console 14.0.1400.2281: Reflected Cross-Site Scripting XSS Overview CVE ID: CVE-2023-34836 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'page' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal. Summa...

CVE-2025-56015

CVE-2025-56015 GenieACS RCE Resumen Prueba de concepto del exploit para CVE-2025-56015 , una vulnerabilidad crítica de escape de la sandbox e inyección de código en GenieACS que permite la ejecución arbitraria de JavaScript en el contexto de aprovisionamiento. Al aprovechar la cadena de prototipo...

CVE-2025-55182_liyon

CVE-2025-55182 - React Server Components RCE ⚠️ Legal Notice : This tool is intended solely for security research, authorized penetration testing, and educational purposes. Using this tool against any system without explicit permission is illegal and unethical. 📋 Overview CVE-2025-55182 is a...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

javascript-obfuscator

Ofuscador de JavaScript 🚀 Obfuscator.io con ofuscación de VM Obfuscator.io añade ofuscación de bytecode basada en VM a este paquete: tus funciones de JavaScript se compilan a bytecode personalizado que se ejecuta en una máquina virtual integrada. Cada compilación produce opcodes y estructura de V...

WebFEET

Web Filter External Enumeration Tool WebFEET WebFEET Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ben Williams https://github.com/nccgroup/webfeet Released under AGPL see LICENSE for more information WebFEET is a web application for the drive-by enumeration of...

Ios-Safari-Mallicous-Extension-Example

Ios-Safari-Mallicous-Extension-Example Example on how to injectioncurrently under work of keylogger js through Safari Extensionthat part done...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

CVE-2026-102667

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

jsluice

jsluice jsluice is a Go package and command-line tool for extracting URLs, paths, secrets, and other interesting data from JavaScript source code. If you want to do those things right away: look at the command-line tool. If you want to integrate jsluice's capabilities with your own project: look ...

CVE-2026-54049 Sakai Conversations has a Stored XSS Issue

Sakai is a Collaboration and Learning Environment CLE. From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in...

CVE-2026-102667 Joyland AI WebView command injection

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

EUVD-2026-91025

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-102667

The Joyland AI app is vulnerable to a JavaScript injection flaw in its WebView component, exploitable by an attacker with shared network access . The root cause allows unauthorized access to the clipboard , app-internal storage , and the ability to make arbitrary HTTP requests via the Weex 'strea...

EUVD-2026-91021

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

CVE-2026-71542 GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...