CVE-2024-4367-POC-PDFJS

CVE 2024 4367: PoC pour l'exploitation de XSS Cross-Site Scripting 1. Displaying an Alert XSS Trigger Another exploitation example consists of injecting a simple alert message to check if the attack works. python poc.py "alert'XSS exploit triggered';" Explanation : This code injects an alert...

CVE-2026-129170

FileCodeBox versions 2.2.1 through 2.8.4 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the renderMarkdownPreview function. The root cause is an improper handling of errors where the markdown parser throws an exception, causing the application to return unsanitized tex...

EUVD-2026-125597

FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing...

CVE-2026-126286

NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check a...

CVE-2026-126279

NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victi...

CVE-2026-126274

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script whe...

CVE-2026-126269

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML...

CVE-2026-126269

NocoDB versions prior to 2026.09.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the software fails to properly neutralize input during web page generation, specifically regarding attachment MIME types . An authenticated Editor user can use the records API t...

CVE-2026-126274 NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script whe...

CVE-2026-126274

NocoDB versions prior to 2026.08.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Delete.vue confirmation dialog, which renders column or table titles via an unescaped innerHTML binding. Authenticated Creator users can exploit this by embedding malicious mark...

EUVD-2026-125242

NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victi...

CVE-2026-126279

NocoDB versions prior to 2026.06.2 are vulnerable to a stored cross-site scripting (XSS) flaw in the PromptWithFields.vue component. The root cause is the rendering of unescaped field references from AI field prompts as HTML within a tooltip. An attacker with Creator privileges or higher can inje...

CVE-2026-126279 NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip

NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victi...

br0w

br0w Hack The Br0w | Play your browser and learn more, hack fun !! The Br0w is a simple web to learn about and about web security with a browser as a tool that sometimes people forget about more benefits. Maybe it's more like Capture The Flag CTF. One of the challenges is, disable css and base64...

PT-2026-146605

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script whe...

PT-2026-146600

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.09.0 Description An authenticated Editor user can execute scripts by storing crafted attachment MIME types, such as text/html;image/png. This is achieved by writing values through the records API, which causes the...

CVE-2026-126269: nocodb: NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to…

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML...

PT-2026-146610

NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victi...

CVE-2020-12432

CVE-2020-12432 Collabora CODE Click here 4. The victim opens the link and gets redirected to another service with all his cookies and local storage data sent over to another network Vi...

Kotaemon-CVE-2025-56526-56527-disclosure

Kotaemon CVE-2025-56526 & CVE-2025-56527 Public Disclosure Stored Cross-Site Scripting in the Kotaemon Information Panel combines with plaintext credential storage in localStorage, enabling full session compromise from a single malicious PDF upload. Executive Summary Affected Product / Versions :...