br0w

br0w Hack The Br0w | 玩转你的浏览器，学习更多, 快乐黑客！！ Br0w 是一个简单的网页，用于学习 Web 安全知识，以浏览器为工具，有时人们会忘记它的更多好处。也许它更像是一种夺旗赛（CTF）。 其中一个挑战是，通过控制台禁用 CSS 和 Base64 编码解码。在 https://labs.tegalsec.org/br0w/ 上玩更多吧！ 挑战列表 : root@kitploit: 挑战 1 | User-Agent 挑战 2 | POST 数据 挑战 3 | Cookie 挑战 4 | LocalStorage 挑战 5 | 外部 CSS（控制台） 挑战 6...

CVE-2020-12432

CVE-2020-12432 Collabora CODE = 4.2.2 - XSS almacenado y permisos inseguros en la API WOPI de Vereign secuestro de cuenta - 4.2.2 Versiones afectadas: Collabora CODE = 4.2.2 Requisitos de explotación: La interfaz de la API /wopi/ de Vereign debe ser accesible utilizando el token generado...

CVE-2024-4367-POC-PDFJS

CVE 2024 4367: 利用XSS（跨站脚本）的PoC 1. 显示弹窗（XSS触发） 另一个利用示例是注入一个简单的警告消息，以验证攻击是否有效。 root@kitploit: python poc.py "alert'XSS exploit triggered';" 说明 ：此代码在页面中注入一个弹出警告框，从而可以快速测试XSS利用是否在目标站点上执行。 2. 窃取Cookie XSS攻击可用于窃取受害者的Cookie，并将其发送到恶意服务器。 root@kitploit: python poc.py "fetch'http://localhost:3000/cookie',...

Kotaemon-CVE-2025-56526-56527-disclosure

Kotaemon CVE-2025-56526 与 CVE-2025-56527 公开披露 Kotaemon 信息面板中的存储型跨站脚本与 localStorage 中的明文凭据存储相结合，使得单个恶意 PDF 上传即可导致完全会话劫持。 执行摘要 受影响产品/版本 ：Kotaemon = 0.11.0（包括提交 37cdc28） 漏洞 ： CVE-2025-56526 – 通过未净化的 PDF 内容渲染导致的存储型 XSS CVE-2025-56527 – localStorage 中存储明文用户名/密码 所需权限 ：具有文档上传权限的认证用户 影响 ：凭证窃取、持久化会话劫持、LLM...

Astra Linux – Vulnerability in Firefox

When Firefox is configured to block the storage of all cookies, it is still possible to store data in localstorage by using an iframe with a source of ‘about:blank’. This could allow malicious websites to store tracking data without permission. This vulnerability affects Firefox versions earlier...

EUVD-2026-60437

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-74234

...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

PT-2026-76764

Name of the Vulnerable Software and Affected Versions Legora versions prior to 2026-08-14 Description A cross-site scripting issue exists where attackers can execute arbitrary JavaScript in a victim's browser. This occurs when a Mermaid block is prefixed with a gray-matter JavaScript front-matter...

CVE-2026-70492

Open WebUI had a stored XSS vulnerability in KaTeX render-fallback: between 0.10.0 and 0.11.0, KaTeX errors could be rendered via HTML (via {@html}) in rendered messages, allowing script execution in viewers’ browsers and risking session token theft and potential admin account takeovers. Affected...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729 Loytec LWEB802: Exposure of Sensitive Information in browser localStorage

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

The CVE-2026-55729 entry concerns Loytec LWEB802 (before 5.0.8) where a vulnerability in the browser localStorage can expose management credentials. An unauthenticated remote attacker can leak credentials via a crafted link. Product: Loytec LWEB802; component: browser localStorage; root cause: in...

PT-2026-64301

Name of the Vulnerable Software and Affected Versions Loytec LWEB-802 versions prior to 5.0.8 Description An issue exists where sensitive information is exposed within the browser localStorage. This allows an unauthenticated remote attacker to leak stored management credentials by using a crafted...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file-download API endpoint in the LocalStorage process. An attacker can access arbitrary files on the server filesystem, including sensitive data such as embedded databases, secrets, and environment variables...

CVE-2026-49984

CVE-2026-49984 – Kestra : A path traversal vulnerability in the LocalStorage backend allows any authenticated user who can view an execution to read arbitrary files on the server. Before patching, the LocalStorage path validator mishandles Windows-style backslashes, letting an attacker smuggle tr...

GHSA-HJ85-PH9Q-78JG NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

Summary The shared form-view submit handler in NocoDB writes the form's redirecturl to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role or above on any base can plant a javascript: URL in the form's redirecturl; when an authenticated view...

Linux Distros Unpatched Vulnerability : CVE-2026-49128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local...

CVE-2026-49128

Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without...