CVE-2022-31298

CVE-2022-31298 Haraj Script 3.7 - Authenticated Stored XSS Exploit Title: Haraj Script 3.7 - Authenticated Stored XSS Date: 2022-06-13 CVE: CVE-2022-31298 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://angtech.org/ Software Link: https://angtech.org/product/view/3 Version: 3.7...

CVE-2026-8333: Microchip TimePictra: A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated,…

A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 is a reflected XSS vulnerability in Wonder CMS which further allows to execute arbitrary code through a malicious script via the installModule component. Usage Running the exploit against the target's loginURL, specifying our IP and port for the web server hosting th...

Malicious code in extrahtml (PyPI)

Source: kam193 f004357dd044b3c2c644a1f759dcd47a154a37533635280af0f3b5adb76469a4 In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub. --- Category:...

Malicious code in parseyaml (PyPI)

Source: kam193 21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3 In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub. --- Category:...

MAL-2026-18771 Malicious code in extrahtml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2338a0148505cc5bfc4b9dad9d4894407f5267cb13e95e300262f240c254ab27 The extrahtml 0.1.1 sdist ships no implementation of the library it advertises. The README documents RequestsEngine, SeleniumEngine and...

Malicious code in pyprig (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83ccb335aa01c8a31acb208aa2f1c2654ab010f9f3cc29fd2f1e6f60a44113f8 pyprig impersonates pydantic: the package name, description 'Data validation using Python type hints', and README are near-verbatim clones of pydanti...

Cross-site Scripting (XSS)

Overview org.webjars.npm:ckeditor5 is an A set of ready-to-use rich text editors created with a powerful framework. Made with real-time collaborative editing in mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the checkShouldRenderAttribute method in...

Cross-site Scripting (XSS)

Overview @ckeditor/ckeditor5-engine is a The editing engine of CKEditor 5 – the best browser-based rich text editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the checkShouldRenderAttribute method in domconverter.ts, where the sanitization regex used to stri...

Cross-site Scripting (XSS)

Overview ckeditor5 is an A set of ready-to-use rich text editors created with a powerful framework. Made with real-time collaborative editing in mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the checkShouldRenderAttribute method in domconverter.ts, where t...

Stormshield Network Security Cross-Site Scripting Vulnerabilities

Stormshield Network Security versions 5.0.0 to 5.0.9 and 5.1.0 to 5.1.3 have a cross-site scripting vulnerability. This vulnerability stems from DOM-based cross-site scripting issues in the web management panel. Attackers can exploit this vulnerability by constructing specific parameter URLs...

Malicious code in voltswannts (PyPI)

Source: kam193 5fa306d5f7de491546822f6b026c35cc395d7d379258b7a8382b50468ce708b2 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in pyrechoasr (PyPI)

Source: kam193 abd16e8f67cf00b05cd9b944eaae2569a33cd419f50b3df499f203ea838fc447 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in tonemaptts (PyPI)

Source: kam193 19491cfac57ebbc5106857c286eb420bb2c84f246781670579fc4311cb7d1cad The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in quasitonnts (PyPI)

Source: kam193 6b73744742a9129ba02b40242325d596780af7d8e456c7040e8458d29c125540 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in novalithtts (PyPI)

Source: kam193 4d136563fb3f5bd0febb4dc01f0af8d3ce9638271f1416f814d126fb49239840 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in glassbeakasr (PyPI)

Source: kam193 de05a7ca1743ea6c3ceba4abc7f5452783d567b39f20007aeb57071a6d4019ed The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in driftwavets (PyPI)

Source: kam193 e69baa6a16626f26b6f71e04ce89a53a693a06c6545446a9addbecfd6c95d92f The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in emberlytts (PyPI)

Source: kam193 c53182f7339fc139b58f28bdd6588e55eb25c1c6d07089f6fc57b87f8339f547 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in tonemaptts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d30c3584f91da98dea7065e548acd378e0c1fa8abe692bbfd20c4abb384e05e Package tonemaptts version 0.1.0 was scanned 6 files. No install-time network I/O, no credential or environment harvesting, no suspicious lifecycle...