75282 matches found
SUSE CVE-2026-116583
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...
CVE-2025-56800
CVE-2025-56800 Local Authentication Bypass Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-290: Authentication Bypass by Spoofing CVSS : 5.1 MEDIUM Vector String : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N...
SUSE CVE-2026-118007
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
SUSE CVE-2026-118014
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
SUSE CVE-2026-118026
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...
CLEANSTART-2026-GW52449 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...
CVE-2026-30082
Stored Cross-site Scripting XSS vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server Affected version: IngEstate Server - 11.14.0 Affected Function Affected API: Affected API: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC To exploit this Stored...
PT-2026-129097
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through proto to assign arbitrary...
CVE-2024-47875-PhpSpreadsheet-XSS-PoC
CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...
CVE-2024-4367
CVE-2024-4367 POC Usage python poc.py mal.pdf "alert'0xr2r'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC scaner templates...
msgpack-CVE-2021-23410-test
Test for https://snyk.io/vuln/SNYK-JS-MSGPACK-1296122 This looks like not vulerbility. var assert = require'assert'; var msgpack = require'msgpack'; function sleepms return new Promiseresolve = setTimeoutresolve, ms; ; async function init var normal = "a": 1, "b": 2, "c": 1, 2, 3 ; var malicious ...
CVE-2019-0678
Vulnerability Microsoft Edge Elevation of Privilege Vulnerability Vulnerability Description This vulnerability allows an attacker to execute javascript code on every host without the permission, also an attacker can steal local system files, and this also results in changing internal developer...
CVE-2023-46948
CVE-2023-46948 - Reflected XSS in Temenos T24 R19.40 A reflected Cross-Site Scripting XSS vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript code in an authenticated victim browser-based web console. Affected Product: Temenos T24 -...
CVE-2024-6529
Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...
CVE-2024-52794-Discourse-Stored-XSS
CVE-2024-52794 – Stored Cross-Site Scripting XSS in Discourse Summary I discovered a stored cross-site scripting XSS vulnerability in Discourse, an open-source forum platform. The vulnerability allows an attacker to execute arbitrary JavaScript in the victim’s browser by injecting a malicious...
Good-MITM
Good Man in the Middle 中文版 Rule-based MITM engine. Rewriting, redirecting and rejecting on HTTPS requests and responses, supports JavaScript. Features Signing certificate automatically based on TLS ClientHello SNI extension Support selective MITM for specific domains Rule description language bas...
GHSA-RH54-VFFM-5FVP CKEditor: Cross-site scripting (XSS) in the engine package
Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...
CVE-2026-116688
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...
CVE-2021-25646
Apache Druid RCE title="druid" && title=="Apache Druid" POST /druid/indexer/v1/sampler?for=filter HTTP/1.1 Host: x.x.x.x:8888 Content-Length: 612 Accept: application/json, text/plain, / Origin: http://x.x.x.x:8888 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko...
