Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the overdue section due to improper input sanitization. An attacker can inject malicious scripts and compromise user data, session tokens, and potentially execute unauthorized actions on behalf of users by...

Angry Likho: Old beasts in a new forest

Angry Likho referred to as Sticky Werewolf by some vendors is an APT group we've been monitoring since 2023. It bears a strong resemblance to Awaken Likho, which we've analyzed before, so we classified it within the Likho malicious activity cluster. However, Angry Likho's attacks tend to be...

HTTP Fetch

Fetch and execute an ARMBE payload from an HTTP server. Module Options msf use payload/cmd/linux/http/armbe/meterpreterreversehttp msf payloadmeterpreterreversehttp show actions ...actions... msf payloadmeterpreterreversehttp set ACTION msf payloadmeterpreterreversehttp show options ...show and s...

Exploit for SQL Injection in Eniture Ltl_Freight_Quotes

CVE-2024-13479 LTL Freight Quotes – SEFL Edition = 5.6 AND err...

Keycloak allows cross-site scripting (XSS)

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items Resource and Permissions from the admin console, leading to a stored cross-site scripting XSS attack...

Web Security Training

This document is aimed at those who want to learn more about web security and application penetration testing. It is coupled with a free course and provides topics with a few bullet points describing what the vulnerability entails, then a screenshot and relevant payload, demonstrating the...

CVE-2024-28277

In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subjectname= parameter, enabling Stored Cross-Site Scripting XSS attacks. This vulnerability allows attackers to manipulate the subject's name, potentially leading to the execution of malicious JavaScript payloa...

CVE-2025-0054

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web...

thunderbird: Unsanitized address book fields

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For...

Prototype Pollution

Vxe-table is vulnerable to Prototype pollution. The vulnerability is due to prototype pollution in the lib.install function, which allows attackers to supply a crafted payload, leading to a Denial of Service DoS...

Prototype Pollution

eazy-logger is vulnerable to prototype pollution. The vulnerability is due to prototype pollution caused by the lib.Logger function allowing attackers to supply a crafted payload, leading to a Denial of Service DoS...

CVE-2024-57278

A reflected Cross-Site Scripting XSS vulnerability exists in /webscan/sqlmap/index.html in QingScan =v1.8.0. The vulnerability is caused by improper input sanitization of the query parameter, allowing an attacker to inject malicious JavaScript payloads. When a victim accesses a crafted URL...

CVE-2024-54853

A Stored Cross-Site Scripting XSS vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows remote authenticated users to store malicious payloads in the affected field that would then execute in an unsuspecting victim's browser...

CVE-2024-57098

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...

CVE-2024-57084

A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57278

A reflected Cross-Site Scripting XSS vulnerability exists in /webscan/sqlmap/index.html in QingScan =v1.8.0. The vulnerability is caused by improper input sanitization of the query parameter, allowing an attacker to inject malicious JavaScript payloads. When a victim accesses a crafted URL...

CVE-2024-57278

The CVE-2024-57278 entry concerns QingScan versions <= 1.8.0 with a reflected Cross-Site Scripting (XSS) vulnerability in /webscan/sqlmap/index.html. The root cause is improper input sanitization of the query parameter, enabling an attacker to inject malicious JavaScript that executes in the v...

CVE-2024-57278

A reflected Cross-Site Scripting XSS vulnerability exists in /webscan/sqlmap/index.html in QingScan =v1.8.0. The vulnerability is caused by improper input sanitization of the query parameter, allowing an attacker to inject malicious JavaScript payloads. When a victim accesses a crafted URL...

CVE-2024-13417

Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their...

CVE-2024-13417

Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their...