toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

PT-2026-99381

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description Certain API responses fail to filter sensitive columns, allowing an authenticated non-superadmin admin with the customers see all flag to access the panel domains.dkim privkey field. This occurs whe...

SUSE-SU-2026:21867-1 Security update for gnutls

This update for gnutls fixes the following issues - CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive bsc1263707. - CVE-2026-5260: lib/pkcs11privkey: guard against overreading on short ciphertexts bsc1263715. - CVE-2026-5419: gnutlscipherdecrypt3: make PKCS7 unpadding...

CVE-2026-5549

A vulnerability was determined in Tenda AC10 16.03.10.10multiTDE01. Affected by this issue is some unknown functionality of the file /webrootro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . The atta...

PT-2024-22602

Name of the Vulnerable Software and Affected Versions GnuTLS affected versions not specified Description A flaw was found in GnuTLS, known as the Minerva attack, which is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In...

Information Disclosure

ansible is vulnerable to information disclosure. The nolog feature is not enabled by default and confidential information such as the authkey and privkey are logged to the console...

PT-2018-4470

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description The issue occurs while processing QSEE Syscall 'qsee macc gen ecc privkey' in Android, resulting in an untrusted pointer dereference. This could lead to arbitrary write. The...

CVE-2014-4526

Multiple cross-site scripting XSS vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 message, 2 zoneid, 3 pubKey, or 4 privKey parameter...

PT-2014-5953

Name of the Vulnerable Software and Affected Versions efence plugin versions 1.3.2 and earlier for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via the message, zoneid, pubKey, or privKey parameter in the callback.php file. Recommendations For...

CVE-2014-4526: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 message, 2 zoneid, 3 pubKey, or 4 privKey parameter...