Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: Cross-Site Scripting XSS reflejado Resumen CVE-2023-34837 es una vulnerabilidad de Cross-Site Scripting XSS reflejado descubierta en Microworld Technologies eScan Management Console versión 14.0.1400.2281. La vulnerabilidad existe en el parámetro POST...

CSRF-exploit-generator

CSRF-exploit-generator El generador de exploits CSRF permite a los usuarios generar un formulario de explotación CSRF con parámetros configurables. CSRF-exploit-generator Características URL de destino de entrada: Especifica la URL que se va a explotar. Parámetros POST de entrada: Permite añadir...

PT-2026-104423

Name of the Vulnerable Software and Affected Versions @opentelemetry/instrumentation-cassandra-driver versions prior to 0.66.0 @opentelemetry/instrumentation-knex versions prior to 0.65.0 @opentelemetry/instrumentation-mongoose versions prior to 0.67.0 @opentelemetry/instrumentation-mysql version...

Linux Distros Unpatched Vulnerability : CVE-2026-103923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-104872: Insertion of Sensitive Information into Log File

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose,...

PT-2026-104084

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

PT-2026-104403

Name of the Vulnerable Software and Affected Versions Tinypool versions prior to 2.1.2 Description Tinypool reads the filename from a caller-supplied options object in the pool.runtask, options function without verifying if the property is an own property of the object. This allows a polluted...

CVE-2025-7840

CVE-2025-7840 XSS漏洞利用工具 作者 : Byte Reaper @ByteReaper0 描述 针对 CVE-2025-7840 的概念验证利用代码，目标是预订表单中 Firstname 参数未正确清理用户输入的可疑 Web 应用端点。通过构造如下 GET 请求： /index.php?page=reserve&Firstname=&Lastname=test 攻击者可以在受害者浏览器渲染响应时注入并执行任意 JavaScript。 功能特性 通过 -b 选项注入自定义载荷 通过 -c 选项处理基于 Cookie 的会话 详细日志记录，用于请求/响应分析（-v）...

CVE-2025-54589

CVE-2025-54589 – Copyparty 反射型 XSS 作者： Byte Reaper 描述： 该仓库提供了一个针对 CVE-2025-54589 的概念验证（PoC）和简单利用程序，该漏洞是 Copyparty ≤ 1.18.6 中的一个反射型跨站脚本（XSS）漏洞。 通过将精心构造的 JavaScript 载荷注入到 filter 参数中，该工具能够自动检测漏洞并记录成功的反射结果。 功能特性： 支持 HTTP 和 HTTPS 目标 可选的自定义 cookie 和 CA 文件支持 自动颜色检测 （终端支持，可使用 --no-color 禁用） 详细...

CVE-2023-34836

CVE-2023-34836 — eScan Management Console 14.0.1400.2281: Cross-Site Scripting XSS Reflejado Resumen ID CVE: CVE-2023-34836 Tipo de Vulnerabilidad: Cross-Site Scripting XSS Reflejado Producto Afectado: Microworld Technologies eScan Management Console Versión Afectada: 14.0.1400.2281 Severidad:...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS 反射型跨站脚本（XSS）漏洞 Tiki CMS - 'page' 参数反射型跨站脚本（XSS）漏洞 免责声明 仅用于教育、研究和防御目的 。未经许可对系统进行未授权使用是违法的。 摘要 在 Tiki 版本 26.3 及更早版本的 tiki-editpage.php 中的 page 参数存在反射型跨站脚本（XSS）漏洞。攻击者可通过构造的载荷执行任意 JavaScript 代码，可能导致敏感信息泄露或未授权操作。 受影响的产品 产品：Tiki CMS Groupware 版本：26.3 及更早版本 组件：tiki-editpage.php...

CVE-2025-56015

CVE-2025-56015 GenieACS RCE Resumen Prueba de concepto del exploit para CVE-2025-56015 , una vulnerabilidad crítica de escape de la sandbox e inyección de código en GenieACS que permite la ejecución arbitraria de JavaScript en el contexto de aprovisionamiento. Al aprovechar la cadena de prototipo...

CVE-2025-55182_liyon

CVE-2025-55182 - React Server Components RCE ⚠️ 法律声明 : 此工具仅用于安全研究、授权渗透测试和教育目的。在未获得明确许可的情况下，将此工具用于目标系统是非法且不道德的。 📋 概述 CVE-2025-55182 是 React Server Components RSC 中的一个关键远程代码执行RCE漏洞，允许未认证的攻击者通过恶意的JavaScript反序列化在服务器上执行任意代码。 🎯 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2025-55182 CVSS 评分| 9.8 严重 攻击向量| 网络 攻击复杂度| 低...

javascript-obfuscator

Ofuscador de JavaScript 🚀 Obfuscator.io con ofuscación de VM Obfuscator.io añade ofuscación de bytecode basada en VM a este paquete: tus funciones de JavaScript se compilan a bytecode personalizado que se ejecuta en una máquina virtual integrada. Cada compilación produce opcodes y estructura de V...

WebFEET

Web Filter External Enumeration Tool WebFEET WebFEET Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por Ben Williams https://github.com/nccgroup/webfeet Publicado bajo AGPL; consulte LICENSE para más información WebFEET es una aplicación web para la...

Ios-Safari-Mallicous-Extension-Example

Ios-Safari-Mallicous-Extension-Example Ejemplo de cómo realizar la inyección actualmente en desarrollo de keylogger js mediante Safari Extension esa parte ya está hecha...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Vulnerabilidad de Ejecución Remota de Código Vídeo demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk El componente G2 Control de Real Player contiene una vulnerabilidad de ejecución remota de código porque permite que se pasen URI 'javascript:' como...