posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

posta

Posta Posta 는 크로스 문서 메시징 통신을 조사하기 위한 도구입니다. postMessage 취약점을 추적, 탐색 및 악용할 수 있으며, 연결된 브라우저 내에서 창 간에 전송된 메시지를 재생하는 기능을 포함합니다. 사전 요구사항 Google Chrome / Chromium Node.js 선택 사항 설치 개발 환경 개발 환경에서 Posta 실행: 1. Posta 설치 git clone https://github.com/benso-io/posta cd posta npm install 2. 개발 환경 시작 npm start ...

html-poc

클라이언트 측 취약점에 대한 개념 증명 코드 다음과 같은 문제에 대한 기본 HTML 개념 증명: 클릭재킹 안전하지 않은 CORS 설정 CSRF 탭내핑 XSSI postMessage 문제 대부분은 매우 기본적이지만, 모든 것을 한 곳에 모으면 같은 내용을 반복해서 작성하지 않아도 됩니다. 조금 더 흥미로운 두 가지: clickjackingfull.html: 실제 환경에서의 다중 클릭 클릭재킹 악용을 위한 고급 클릭재킹 스크립트 자세한 내용은 블로그 게시물 ClickAnywhere: An Advanced Clickjacking...

PwnFox

PwnFox PwnFox는 보안 감사를 위한 유용한 도구를 제공하는 Firefox/Burp 확장 프로그램입니다. Chrome 사용자라면 https://github.com/nccgroup/autochrome을 확인해보세요. PwnFox 기능 원클릭 BurpProxy 컨테이너 프로필 PostMessage 로거 도구 상자 보안 헤더 제거기 설치 빌드 Firefox Burp 변경 내역 기능 원클릭 BurpProxy 간단한 클릭으로 Burp에 연결하세요. 이렇게 하면 foxyProxy와 같은 다른 애드온이 필요하지 않을 수 있습니다...

CVE-2026-100182

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100182

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.10 . The root cause is insufficient input sanitization and output escaping involving Cross-Origin postMessage to the Admin Editor. An unauthenticated attacker can t...

EUVD-2026-91245

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

PT-2026-104117

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

advisories

소개 트위터: @justinsteven 블로그: https://www.justinsteven.com/ 권고Advisories 최신순으로 나열됨. 전체 권고를 읽으려면 제목을 클릭하세요. Gartner Peer Insights Widget postMessage DOM XSS 공개 날짜: 2023-02-03 Gartner Peer Insights Widget은 호스트명에 "gartner.com"이 포함된 모든 사이트예: https://gartner.com.attacker.com에서 온 postMessage 메시지로 트리거될 수 있...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85682

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682

The YOP Poll plugin for WordPress (versions up to and including 7.0.10 ) is vulnerable to an Origin Validation Error . The root cause is the plugin transmitting a wp_rest nonce to window.opener via postMessage() using a wildcard targetOrigin . This allows an unauthenticated attacker to steal a RE...

EUVD-2026-85816

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

PT-2026-97734

Name of the Vulnerable Software and Affected Versions YOP Poll versions prior to 7.0.11 Description The plugin contains an origin validation error where it transmits a wp rest nonce to window.opener using the postMessage function with a wildcard targetOrigin. This allows unauthenticated attackers...

CVE-2026-85682: Origin Validation Error

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...