CVE-2026-15776

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=532595489...

MAMP Server - Cross-Site Scripting Detection

A Cross-Site Scripting XSS vulnerability exists in the default installation of MAMP server. The file /Applications/MAMP/htdocs/index.php is susceptible to malicious input, allowing attackers to inject JavaScript code that executes in the context of the victim's browser. This vulnerability can be...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting Detection

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

Revive Adserver <=5.0.3 - Cross-Site Scripting Detection

Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet is vulnerable to cross-site scripting via the devicegraphpage.php script via the is2sim parameter. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet is...

QSAN Storage Manager <3.3.3 - Cross-Site Scripting Detection

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. !/usr/bin/env python3 -- coding: utf-8 -- """QSAN Storage Manager before...

XWiki >= 6.0-rc-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as:...

idcCMS V1.60 - Cross-Site Scripting Detection

idcCMS V1.60 is vulnerable to reflected cross-site scripting XSS via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """idcCMS V1.""" from kittysploit import from...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA...

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting Detection

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter. !/usr/bin/env python3 -- coding: utf-8 -- """The WallboardServlet resource in Jira before version 7."""...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting Detection

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting Detection

AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting XSS via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """AcuToWeb server/10.""" from kittysploit import fr...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Mailcow < 2026-03b - Href Link Injection Detection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. !/usr/bin/env python3 -- coding: utf-8 -- """mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the...

Devtron JavaScript Environment Configuration - Exposure Detection

Devtron JavaScript environment configuration file was identified at /dashboard/env-config.js, exposing internal API endpoints and feature flag settings. !/usr/bin/env python3 -- coding: utf-8 -- """Devtron JavaScript environment configuration file was identified at /dashboard/env-config.""" from...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...