75279 matches found
CVE-2026-2964-Lab
CVE‑2026‑2964 Lab – Prototype Pollution to RCE This repository contains a complete lab environment for CVE‑2026‑2964, a prototype pollution vulnerability in the web‑audio‑recorder‑js library that can lead to remote code execution under specific conditions. The lab includes: A vulnerable server...
CVE-2025-55580
CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...
CVE-2024-28397-Js2Py-RCE
CVE-2024-28397-Js2Py-RCE Description This repository contains a Python-based Proof of Concept PoC for CVE-2024-28397, a sandbox escape vulnerability in the Js2Py JavaScript interpreter for Python. When the target application evaluates untrusted JS code via Js2Py, an attacker can break out of the...
jsluice
jsluice jsluice is a Go package and command-line tool for extracting URLs, paths, secrets, and other interesting data from JavaScript source code. If you want to do those things right away: look at the command-line tool. If you want to integrate jsluice's capabilities with your own project: look ...
CVE-2026-29598
CVE-2026-29598: Stored Cross-Site Scripting XSS in cm3 Acora CMS version 10.7.1. DDSN Interactive cm3 Acora CMS version 10.7.1 contains a Stored Cross-Site Scripting XSS vulnerability in the user management functionality. An administrator with the ability to add or edit user details can...
CVE-2021-23639
Overview md-to-pdf is a CLI tool for converting Markdown files to PDF. Affected versions of this package are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine. Usage: python3 cve-2021-23639.py targerurl...
v8-poc-CVE-2026-5865
Minimal .js PoC for v8 CVE-2026-5865 Quick Run Install deps: pip install -r requirements.txt Patch/calibrate exploit: python3 patchexploit.py /path/to/d8 exploit.js Run exploit: ./run-exploit.sh /path/to/d8 exploit.js...
cve-2024-21683-rce
cve-2024-21683-rce CVE-2024-21683 is a critical remote code execution RCE vulnerability affecting Atlassian's Confluence Server and Data Center. This vulnerability has a CVSS score of 8.3, placing it in the high-severity category. Attackers can exploit this vulnerability to execute remote code by...
svg-sanitizer
SVG Sanitizer SVG Sanitizer is a Java library designed to clean SVG files by removing potentially dangerous JavaScript, blocking external resource loading, and preventing XSS Cross-Site Scripting vulnerabilities. It is useful for ensuring that SVG files are safe to use in a variety of application...
CVE-2026-118026
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
CVE-2026-118014
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
CVE-2026-118007
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
CVE-2026-117994
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
CVE-2026-117982
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
CVE-2026-117942
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
CVE-2026-117946
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
CVE-2026-117955
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...
CVE-2026-117969
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...