73140 matches found
Payload: Uploaded XML files could execute same-origin JavaScript
Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads accepted by default. Patches Users should upgrade Payload packages to = 3.90.0 o...
GHSA-9QPG-3CF8-W33X Payload: Uploaded XML files could execute same-origin JavaScript
Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads accepted by default. Patches Users should upgrade Payload packages to = 3.90.0 o...
NPM: Payload: Uploaded XML files could execute same-origin JavaScript
NPM: Payload: Uploaded XML files could execute same-origin JavaScript vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...
Security Bulletin:ip-address IPv4-mapped/NAT64 IPv6 Address SSRF Vulnerability Fix in 10.2.1
Summary ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...
DRUPAL-CONTRIB-2026-195
This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...
CVE-2025-70519
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
CVE-2025-70515
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
CVE-2026-25860
CVE-2026-25860 OpenClinic GA 5.247.01 DICOM 图像上传处理器中的反射型 XSS 如果你想将此 XSS 与 RCE 结合利用，可以阅读： https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce 描述 OpenClinic GA " + obj.getStringTag.StudyDescription.replaceAll"\^"...
CVE-2026-102258
Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...
CVE-2026-102258
Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...
CVE-2026-102258
A post-authentication Stored Cross-Site Scripting (XSS) vulnerability exists in the SonicWall SMA1000 appliance's Management Console (AMC) . Under specific conditions, a remote authenticated attacker with administrator privileges can store and execute arbitrary JavaScript code within the AMC. Thi...
CVE-2026-102258
Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...
EUVD-2026-94224
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...
CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App
URVE Smart Office iOS — タイルHTMLフィールドを介したStored XSS（PoC） このリポジトリは、URVE Smart Office のiOSモバイルアプリケーション に影響を与えるStored Cross-Site Scripting（XSS）脆弱性 の概念実証（PoC） を文書化しています。 入力バリデーションの不備により、攻撃者が制御可能なJavaScriptがタイルのHTMLフィールド に注入される可能性があります。ペイロードは保存され、後に影響を受けるコンテンツがモバイルクライアントに配信されiOS端末上でレンダリングされる際に実行されます。 ⚠️...
CVE-2015-3073
CVE-2015-3073 この脆弱性により、リモート攻撃者はAdobe Readerの脆弱なインストール環境においてAPI制限を回避することが可能です。この脆弱性を悪用するにはユーザーの操作が必要であり、標的となるユーザーが悪意のあるページにアクセスするか、悪意のあるファイルを開く必要があります。 具体的な欠陥はAFParseDateに存在します。特定のJavaScript命令を含む特別に細工されたPDFを作成することで、JavaScript APIの制限を回避することが可能です。リモート攻撃者はこの脆弱性を悪用して任意のコードを実行する可能性があります。...
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
The Computer Emergency Response Team of Ukraine CERT-UA has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer aka Psychedelic Stealer. The activity, which was observed by the agency in...
CVE-2024-4367-hands-on
!IMPORTANT 本リポジトリは、脆弱性を学習するためのものです。 本ハンズオンは、必ず自分の管理する適切なコンピュータで行ってください。違法行為は絶対に行わないでください。 また本リポジトリによって発生した、一切の損害・責任を、作者は負いません。 CVE-2024-4367-hands-on CVE-2024-4367を体験するハンズオン poc.pdfの作成 python CVE-2024-4367-PoC/CVE-2024-4367.py "alert'document.domain'"...
javascript-deobfuscator
javascript-deobfuscator 用于 javascript-obfuscator 5.x 输出的反混淆器。输入混淆后的 JS，返回可读且运行结果相同的 JS。 安装 需要 Node 18+ 。 git clone https://github.com/lolcaken/javascript-deobfuscator.git cd javascript-deobfuscator npm install npm run build 用法 反混淆一个文件（除非指定 -o，否则在输入文件旁写入 .deob.js）： node dist/src/cli.js input.ob.js...