cve-2025-0133

CVE-2025-0133 反射型XSS検出ツール 作成者 : Derek Odiorne 日付 : 2025-05-23 重要度 : Medium テスト対象 : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 概要 このスクリプトは、Palo Alto NetworksのPAN-OSソフトウェアにおけるGlobalProtectポータルおよびゲートウェイのログインページ の反射型クロスサイトスクリプティング（XSS）脆弱性であるCVE-2025-0133 に対する安全で許可されたテスト を実行します。...

CVE-2026-92212

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.3 . The root cause is insufficient input sanitization and output escaping involving the 'jfb_xss' (URL Query Variable) Parameter vi...

MAL-012

MAL-012: 管理コンソールの反射型クロスサイトスクリプティングによるPayara Serverのリモートコード実行 Payara Admin Consoleで、反射型クロスサイトスクリプティング（XSS）攻撃が発見されました。管理者ユーザーに悪意のあるURLにアクセスさせ、「ファイルを選択」ボタンをクリックさせることで、攻撃者は任意のJavaScriptコードを実行し、ユーザーになりすまして管理機能を悪意のある目的に利用できます。 XSSがPayara Admin...

CVE-2026-78393

The Link Library WordPress plugin (versions before 7.9.6 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly escape certain parameters—specifically the link_tags and link_price parameters—when generating link addresses on front-end directory pages. ...

EUVD-2026-86527

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in...

CVE-2026-78393 Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

VulnScan

VulnScan Scanner di vulnerabilita' web. Fa il crawling di un sito, trova form e parametri, e li prova contro SQL injection, XSS riflesso, path traversal e header di sicurezza mancanti. Produce un report a terminale, un PDF e ha una dashboard Flask. Progetto di apprendimento. L'ho scritto per capi...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Reflected Cross-Site Scripting XSS Table of Contents Overview Vulnerability Details Affected Product Technical Analysis Proof of Concept Steps to Reproduce Impact Mitigation & Remediation References Disclaimer Overview A Reflected Cross-Site Scripting XS...

CVE-2023-33731

CVE-2023-33731 — eScan Management Console: Reflected Cross-Site Scripting XSS -orange Table of Contents Overview Vulnerability Details Severity & CVSS Score Affected Product Technical Analysis Proof of Concept Impact Mitigation & Remediation Disclosure Timeline...

CVE-2025-30374

CVE-2025-30374 Taipy 中的类污染漏洞，可导致 RCE、XSS、DoS 和凭据泄露 摘要 在 Taipy v4.0.3（发现时的最新版本）中发现了一个类污染漏洞。该漏洞允许未经授权的攻击者覆盖 Taipy 服务端运行时上下文，进而导致 RCE、反射型 XSS、拒绝服务（DoS）以及敏感授权凭据（如 OpenAI 令牌）泄露等严重后果。 详情 背景 类污染（类似于 JavaScript 中的原型污染）是 Python 中一个相对较新的漏洞。它发生在攻击者能够在运行时意外覆盖模块的全局变量或某些类与函数的属性时。此问题归类于 CWE-915。 有关类污染的更多信息，请参阅：...

CVE-2024-11252-Sassy-Social-Share-XSS

CVE-2023-XXXX: Sassy Social Share Plugin XSS Vulnerability Description This project demonstrates a reflected Cross-Site Scripting XSS vulnerability found in the Sassy Social Share plugin for WordPress. This vulnerability can be exploited via the heateormastodonshare parameter. Usage 1. PoC.html :...

CVE-2020-23839

CVE-2020-23839 | GetSimple CMS v3.3.16 - リフレクション型XSSからRCEへ エクスプロイト作者: Bobby Cooke boku 脆弱性統計 OWASP Top Ten 2017: A7:2017-クロスサイトスクリプティング XSS CWE-79: ウェブページ生成時の入力の不適切な無害化（'クロスサイトスクリプティング'） - タイプ1: リフレクション型XSS CVSS Base Score: 6.1 MEDIUM CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: Reflected Cross-Site Scripting XSS Overview CVE-2023-34837 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GrpPath POST...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

CVE-2026-88420

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput versions v1.2.1 through v2.2.0 . This flaw allows authenticated attackers possessing Wagtail Editor privileges to execute arbitrary code within a victim's browser by delivering a crafte...

EUVD-2026-87082

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

CVE-2025-7840

XSS Exploit for CVE-2025-7840 Author : Byte Reaper @ByteReaper0 Description Proof‑of‑concept exploit for CVE-2025-7840 , targeting a vulnerable web application endpoint that fails to sanitize user input on the Firstname parameter of a reservation form. By crafting a GET request to: root@kitploit:...

CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Reaper Description : This repository provides a Proof-of-Concept PoC and simple exploit for CVE-2025-54589 , a reflected Cross-Site Scripting XSS vulnerability in Copyparty ≤ 1.18.6. By injecting crafted JavaScript payloads into the filter...

CVE-2025-8550

CVE-2025-8550 – atjiu pybbs XSS Exploit Description This repository hosts an automated Proof-of-Concept PoC exploit for CVE-2025-8550 , a reflected Cross‑Site Scripting XSS vulnerability in atjiu pybbs ≤ v6.0.0. It targets the /admin/topic/list endpoint’s username parameter, which lacks proper...