Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

WordPress Front End Users - Reflected XSS

WordPress Front End Users plugin = 3.2.32 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Revive Adserver 5.4.1 - Cross-Site Scripting

A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions. id: CVE-2023-38040 info: name: Revive Adserver 5.4.1 - Cross-Site Scripting author: ritikchaddha severity: medium description: | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

Zarinpal Paid Download - Reflected XSS

Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires...

WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

Tube Video Ads Lite - Reflected XSS

Tube Video Ads Lite WordPress plugin = 1.5.7 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craf...

Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

CVE-2022-27665

CVE-2022-27665 Une vulnérabilité de type XSS réfléchi via des expressions d'échappement de sandbox AngularJS existe dans Progress/IPSwitch WSFTP Server 8.6.0, qui peut conduire à l'exécution de code et de commandes malveillants côté client en raison d'une gestion inappropriée des entrées fournies...

CVE-2024-42009

CVE-2024-42009 – XSS réfléchi dans Roundcube Webmail 📌 Aperçu Ce dépôt contient un modèle Nuclei et des ressources associées pour démontrer et valider en toute sécurité CVE-2024-42009 , une vulnérabilité critique de XSS réfléchi dans Roundcube Webmail. Le défaut réside dans la fonction messagebod...

CVE-2022-24181

CVE-2022-24181 および CVE-2022-26616。おそらく同じものです。 Open-journal-system-Vulnerability XSS（Host Headerインジェクション経由）と他ユーザーのパスワードリセットトークンの奪取 再現手順: 1. このサイトにアクセス: https://who's-using-ojs-software.com 2. Burpでこのリクエストをキャプチャし、Repeaterに送信。 3. Host Headerの後に以下を追加: X-Forwarded-Host: foo"x=".com 4...

WebGoat.NET

Webgoat.NET 소스 코드: https://github.com/jerryhoff/WebGoat.NET 다운로드 zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master 이 웹 애플리케이션은 일반적인 웹 보안 결함에 대해 학습할 수 있는 플랫폼입니다. 대부분의 웹 애플리케이션에 적용되는 일반적인 보안 결함을 포함하고 있습니다. 또한 .NET 프레임워크와 관련된 구체적인 교훈도 포함되어 있습니다. 이 앱의 실습은 웹 보안 공격과 개발자가 이를 극복하는 방법에 대해 가르치기 ...

poc-cve-xss-uploading-svg

Détails Titre : Cross-Site Scripting Réfléchi Authentifié dans le plugin "Uploading SVG, WEBP and ICO files" pour WordPress CMS Date : 2023-08-10 Auteur : Danilo Albuquerque Page d'accueil du fournisseur : https://wordpress.org Lien du logiciel : https://wordpress.org/download Version : WordPress...

CVE-2025-57389

CVE-2025-57389 - XSS réfléchi dans OpenWRT 18.06.2 Description Une vulnérabilité de cross-site scripting XSS réfléchi a été identifiée dans Luci OpenWRT v18.06.2 EOL, sur le endpoint /cgi-bin/luci/admin/system/packages. Preuve de concept 1. Tout en proxyant le trafic vers Burp, naviguez vers...