https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2021-26832

CVE-2021-26832 Suggested description Cross Site Scripting XSS at the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site. Vulnerability Type...

com.heytap.browser

Informe de Vulnerabilidad Resumen: Se ha descubierto una vulnerabilidad en la aplicación com.heytap.browser en la plataforma Android. La vulnerabilidad permite a un atacante ejecutar código JavsScript arbitrario dentro del contexto de la aplicación sin necesidad de ningún permiso. Detalles de la...

jsprime

作者 Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ 简介 如今，越来越多的开发者选择 JavaScript 作为首选语言。原因很简单：JavaScript 已被广泛接受为应用程序的主流编程语言，无论是 Web 还是移动端，无论是客户端还是服务器端。JavaScript 的灵活性和弱类型让开发者能够以惊人的速度创建丰富的应用程序。近期 JavaScript 解释器性能的重大进步，几乎消除了许多组织对其可扩展性和吞吐量的质疑。关键在于，JavaScript...

InfoLeak-Scanner

InfoLeak-Scanner Docker 首先运行 docker run --rm -p 8000:80 siwecos/infoleak-scanner。 打开浏览器使用扫描器：http://localhost/?url= 安装 安装 php5、curl 和网络服务器： root@kitploit: sudo apt-get install apache2 php5 php5-curl 将应用程序复制到网络服务器目录： root@kitploit: cp -R . /var/www/html/ 这是什么？ 内容管理系统（CMS） Drupal Joomla vbulletin...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - 用于绕过IDS并通过HTML走私传递有效载荷的JS载荷生成器。 描述 关于什么是HTML走私的完整解释可以在这里找到。 HTML走私的主要目标是通过将恶意载荷（例如可执行文件/压缩包等）伪装成看似无害的HTML和JavaScript代码，来绕过网络安全控制，如防火墙和入侵检测系统。通过利用Web应用的动态特性，攻击者可以将恶意内容传递到用户的浏览器，而不会触发安全警报或被传统安全机制检测到。得益于这种技术，恶意文件的下载在现代IDS解决方案中不会以任何方式显示出来。...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 12.0.6 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the cjtoolbox shortcode . This allows authenti...

EUVD-2025-211000

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

VUL4J-60

antisamy Una biblioteca para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para su perfil, comentarios...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

jsfinder

功能 | 安装 | 使用 | 演示 | 待办事项| 联系方式 jsFinder 是一个用 Go 编写的命令行工具，用于扫描网页，查找 HTML 源代码中链接的 JavaScript 文件。它搜索任何可能包含 JavaScript 文件的属性（例如 src、href、data-main 等），并将文件的 URL 提取到文本文件中。该工具设计简单易用，支持从文件或标准输入读取 URL。 jsFinder 对于想要查找和分析 Web 应用所使用的 JavaScript 文件的开发者和安全专业人员非常有用。通过分析 JavaScript 文件，可以了解应用的功能，并检测任何安全漏洞或敏感信息泄露...

keypairvuln

keypair claves vulnerables CVE-2021-41117 Claves generadas con versiones de la librería javascript keypair vulnerables a CVE-2021-41117. Debido a errores en el generador de números aleatorios, esta librería generará ciertas claves con mayor probabilidad. La probabilidad de generar una de las clav...

Garbage-collection-in-v8

Este repositorio no tiene un README...

CVE-2026-97723

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...