CVE-2021-32644

CVE-2021-32644 위 취약점은 Ampache 4.4.3 이전 버전까지 영향을 주었던 XSS 취약점입니다. https://nvd.nist.gov/vuln/detail/CVE-2021-32644 설치 및 실행 순서 1. Ampache 설치 설치를 진행할 때, docker-compose.yml 파일에서 포트포워딩을 진행해주시기 바랍니다. 현재 설치하는 Ampache 버전은 4.4.2 입니다. $docker-compose up 2. Amapache 접속 http://web-server ip:port/로 이동합니다. 2...

CVE-2024-4439

CVE-2024-4439 CVE-2024-4439 docker and poc 랩 설정 Docker 컨테이너를 시작한 후 몇 가지 설정이 필요합니다. 127.0.0.1:8080에 접속하여 구성을 완료한 다음 관리자 페이지 - 외관 - 테마에서 테마를 선택하고, 사용자 정의 및 설정을 진행합니다. 디자인 - 템플릿 - 단일 글single post로 이동합니다. 오른쪽에서 아바타를 선택하고, 테마 편집기로 이동합니다. 먼저 아바타를 클릭한 다음 오른쪽 상단에서 설정을 클릭합니다. 오른쪽에 두 가지 속성사용자 프로필에 연결 및 새 창...

CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 是 YesWiki 的 Bazar 组件处理器中存在的一个反射型 XSS 漏洞。NoSuchPage/widget 端点中的查询参数仅使用 striptags 进行过滤，而该函数不会转义双引号，导致过滤不充分。攻击者可借此突破 HTML 属性边界，将 JavaScript 事件处理器（如 onmouseover）注入到 data-iframeUrl 属性中。 该漏洞已在 4.6.6 版本中通过为 WidgetHandler 方法中的 $urlParams 添加 urlencode 得到修复。 🔬 漏洞详情...

Exploit for CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar...

Exploit for CVE-2024-4041

CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%...

EUVD-2005-2139

Malware in sbrugna...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2005-2138

Cross-site scripting XSS vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message...

CVE-2025-30342: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...

Cross-Site Scripting (XSS)

silverstripe/admin is vulnerable to Cross-Site Scripting XSS . The vulnerability is due to inadequate input validation, allowing an attacker to embed malicious JavaScript through onmouseover or onmouseout attributes in the WYSIWYG editor...

PT-2024-12285 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions 1.7.44 and before Description: A cross-site scripting XSS vulnerability allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element. Recommendations: For Gra...

CVE-2023-31506: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element...

Grav Cross-Site Scripting Vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A cross-site scripting vulnerability exists in Grav 1.7.44 and earlier versions that could allow an authenticated, remote attacker to execute arbitrary web...

PT-2023-33004 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 20.2.0 OpenMage magento-lts versions prior to 20.2.0 Description: The TinyMCE WYSIWYG editor fails to filter scripts when rendering HTML in specially crafted HTML tags, allowing for potential exploitation. This issue...

CVE-2023-23637: Improper Neutralization of Input During Web Page Generation

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...

CVE-2023-23637

CVE-2023-23637 affects IMPatienT before 1.5.2. It allows stored XSS via onmouseover in certain text fields within PATCH /modify_onto to the ontology builder, potentially leading to disclosure of Protected Health Information. CVSS v3.1 base score 7.6 (HIGH), vectors: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:...

Happyforms < 1.22.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Forms" Gutenberg...

CVE-2021-41823

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

CVE-2021-41823: Improper Neutralization of Input During Web Page Generation

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSS

The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin. Exploit...