CVE-2024-50677

CVE-2024-50677 | OroPlatform CMS v5.1 におけるツークリック反射型XSS このリポジトリは、CVE-2024-50677 の概念実証（PoC）を示すものです。 免責事項: このコードは、本脆弱性の概念実証です。本エクスプロイトの使用によって生じたいかなる結果についても、私は責任を負いません。 説明: CVE-2024-50677 は、OroPlatform CMS v5.1...

CVE-2024-5961

CVE-2024-5961 2ClickPortal의 반사형 XSS 버전: 7.2.31부터 7.6.4까지. intext:"Powered by 2ClickPortal" PoC root@kitploit: https://domain/szukaj/?searchlang=pl&search=all&string=" onfocus=alert1 autofocus="...

essential-addons-for-elementor-xss-poc

🔍 Essential Addons for Elementor XSS 취약점 탐지기 🚨 중요 정보 이 도구는 보안 연구 및 패치 목적으로만 사용됩니다. 사이트에 해를 끼치는 데 사용하지 마십시오. 취약한 사이트를 발견한 경우 사이트 소유자에게 책임감 있게 보고하여 즉시 업데이트할 수 있도록 하십시오. ⚠️ 취약점 세부 정보 Essential Addons for Elementor의 반사형 XSS 취약점이 6.0.15 미만 버전을 사용하는 10만 개 이상의 웹사이트에 영향을 미칩니다. 이 취약점에는 CVE-2025-24752 가...

CVE-2023-31853

CVE-2023-31853 Cudy LT400의 웹 기반 관리 인터페이스에 반사형 크로스 사이트 스크립팅XSS 공격이 존재합니다. /cgi-bin/luci/admin/network/bandwidth 페이지에서 icon 파라미터를 통해 반사형 XSS가 발생합니다. 공격 방법은 피해자에게 악성 코드가 포함된 특수하게 조작된 요청을 보내는 것입니다. 영향을 받는 애플리케이션은 세션 쿠키에 HttpOnly 속성을 설정하지 않으며, 이로 인해 세션 토큰 도난을 통해 관리자 계정을 탈취할 수 있습니다. PoC root@kitploit:...

Vulnerable-Docker--CVE-2023-30212-

Vulnerable-Docker-CVE-2023-30212- これは、XSS脆弱性（CVE-2023-30212）を持つOURPHPの脆弱性を再現するために必要なディレクトリとDockerfileを含みます。 脆弱なDocker環境の作成（CVE-2023-30212） 前提条件 Dockerをダウンロード sudo apt install -y docker.io 以下のコマンドを順に実行してください: git cloneを使用してこのリポジトリからファイルをダウンロード git clone...

CVE-2022-23378

CVE-2022-23378 : TastyIgniter v3.2.2 레스토랑 CMS의 반사형 XSS 인증된 반사형 XSS가 TastyIgniter v3.2.2 관리자 대시보드에 존재합니다. Mitre URL: https://vulners.com/cve/CVE-2022-23378 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23378 개념 증명 POC: 관리자 대시보드 알레르겐: 영향받는 URL:...

CVE-2023-36163

익스플로잇 제목: BuildaGate5library - Reflected Cross-Site Scripting XSS 날짜: 06/07/2023 익스플로잇 작성자: Idan Malihi 공급업체 홈페이지: 없음 버전: 5 테스트 환경: Microsoft Windows 10 Pro CVE: CVE-2023-36163 PoC: 공격자는 취약한 매개변수 mc=를 찾아 다음과 같은 JS 코드를 주입해야 합니다: 'div id="aaaa...

cve-2025-0133

CVE-2025-0133 反射型XSS検出ツール 作成者 : Derek Odiorne 日付 : 2025-05-23 重要度 : Medium テスト対象 : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 概要 このスクリプトは、Palo Alto NetworksのPAN-OSソフトウェアにおけるGlobalProtectポータルおよびゲートウェイのログインページ の反射型クロスサイトスクリプティング（XSS）脆弱性であるCVE-2025-0133 に対する安全で許可されたテスト を実行します。...

CVE-2023-41425

CVE-2023-41425 説明 Wonder CMS v.3.2.0 から v.3.4.2 におけるクロスサイトスクリプティング（XSS）の脆弱性により、リモートの攻撃者が installModule コンポーネントにアップロードされた細工されたスクリプトを介して任意のコードを実行できる可能性があります。 動作 添付のエクスプロイト「exploit.py」は以下のアクションを実行します： 1. 3つの引数を受け取ります： URL：WonderCMSがインストールされている場所（パスワードを知る必要はありません） IP：攻撃者のマシンのIPアドレス Port...

CVE-2021-26903

CVE-2021-26903 ISIDA RETRIEVER v5.2" 반사형 XSS 제안된 설명 : "ISIDA RETRIEVER v5.2" 반사형 XSS. 취약한 기능 : ISIDA RETRIEVER 플랫폼은 반사형 XSS에 취약합니다. 취약한 매개변수 : query'text' 발견자 : Alexander Semenenko...

Advance Post Prefix WordPress plugin - Reflected XSS

Advance Post Prefix WordPress plugin through 1.1.1 contains a reflected cross-site scripting caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12734 info: name: Advance...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

XWiki Platform - Cross-Site Scripting

XWiki Platform versions = 4.2-milestone-3 and = 16.5.0-rc-1 and = 17.0.0-rc-1 and = 4.2-milestone-3 and = 16.5.0-rc-1 and = 17.0.0-rc-1 and 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the...

ETQ Reliance - Reflected XSS via SQLConverterServlet

A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...

XWiki >= 13.10.8 - Cross-Site Scripting

Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript. id: CVE-2023-29506 info: name: XWiki = 13.10.8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Reflected XSS vulnerability in XWiki authenticate endpoints allows...

WP BASE Booking - Reflected XSS

WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

Sassy Social Share <= 3.3.3 - Cross-Site Scripting

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateorssssharingcount' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

GTranslate < 2.8.65 - Cross-Site Scripting

In the Pro and Enterprise versions of GTranslate 2.8.65, the gtranslaterequesturivar function runs at the top of all pages and echoes out the contents of $SERVER'REQUESTURI'. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable ...

WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting

WPZOOM Portfolio = 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request. id: CVE-2026-49069 info: name: WPZOOM Portfolio = 1.4.21 - Reflected Cross-Site...