WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

Tube Video Ads Lite - Reflected XSS

Tube Video Ads Lite WordPress plugin = 1.5.7 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craf...

Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

CVE-2022-27665

CVE-2022-27665 Uma vulnerabilidade de XSS Refletido através de expressões de escape do Sandbox AngularJS existe no Progress/IPSwitch WSFTP Server 8.6.0 que pode levar à execução de código malicioso e comandos no cliente devido ao tratamento inadequado da entrada fornecida pelo usuário. Ao inserir...

CVE-2022-24181

CVE-2022-24181 e CVE-2022-26616. Ambos são provavelmente iguais. Open-journal-system-Vulnerability XSS via injeção de Host Header e roubo do token de redefinição de senha de outro usuário Passos para reproduzir: 1. Acesse este site: https://who's-using-ojs-software.com 2. Capture esta solicitação...

WebGoat.NET

Webgoat.NET الكود المصدري: https://github.com/jerryhoff/WebGoat.NET تحميل zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master تطبيق الويب هذا هو منصة تعليمية تحاول التعليم عن عيوب أمن الويب الشائعة. يحتوي على عيوب أمنية عامة تنطبق على معظم تطبيقات الويب. كما يحتوي على دروس تتعلق تحديدًا ...

CVE-2025-57389

CVE-2025-57389 - XSS منعكسة في OpenWRT 18.06.2 الوصف تم تحديد ثغرة أمنية من نوع XSS البرمجة النصية عبر المواقع المنعكسة في الإصدار EOL Luci OpenWRT v18.06.2 على نقطة النهاية /cgi-bin/luci/admin/system/packages. إثبات المفهوم 1. أثناء تمرير حركة المرور عبر Burp، انتقل إلى...

CVE-2024-3867

CVE-2024-3867 Dieses Repository zeigt dir einige Informationen zu dieser Schwachstelle, die von mir gefunden wurde. Hier ist die offizielle Beschreibung: Das Theme archive-tainacan-collection für WordPress ist anfällig für Reflected Cross-Site Scripting aufgrund der Verwendung von addqueryarg ohn...

CVE-2025-7840

CVE-2025-7840 के लिए XSS एक्सप्लॉइट लेखक : Byte Reaper @ByteReaper0 विवरण CVE-2025-7840 के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट, जो एक संवेदनशील वेब एप्लिकेशन एंडपॉइंट को लक्षित करता है, जो रिजर्वेशन फॉर्म के Firstname पैरामीटर पर उपयोगकर्ता इनपुट को सैनिटाइज़ करने में विफल रहता है। एक GET अनुरोध...

CVE-2026-64638

🛡️ CVE-2026-64638 - XSS2Shell XSS réfléchi pré-authentification WordPress avec escalade potentielle vers l'exécution de code PHP 📌 Vue d'ensemble CVE-2026-64638 est une vulnérabilité de Cross-Site Scripting XSS réfléchi en pré-authentification de haute sévérité affectant l'écran de connexion...

CVE-2026-64638

CVE-2026-64638 XSS Refletido na Tela de Login Levando à Execução de Código PHP — WordPress Core Software: WordPress Core ≤ 7.0.2 todas as versões anteriores à 7.0.3 CVSS: 8.9 Alto CWE: CWE-79 — Neutralização Incorreta de Entrada Durante a Geração de Páginas Web Autenticação Necessária: Nenhuma...

CVE-2025-30374

CVE-2025-30374 Vulnerabilidade de Poluição de Classe no Taipy que Leva a RCE, XSS, DoS e Vazamento de Credenciais Resumo Uma vulnerabilidade de poluição de classe foi identificada no Taipy v4.0.3 a versão mais recente na época da descoberta. Essa vulnerabilidade permite que atacantes não...

CVE-2022-46104---POC

CVE-2022-46104 https://www.sourcecodester.com/ मानव संसाधन प्रबंधन प्रणाली परियोजना के loginn.php पृष्ठ पर XSS पाया गया है: निष्पादन पेलोड: http://localhost/hrm/loginn.php?msg=%3Cscript%3Ealert%27XSS%27%3C/script%3E...

CVE-2023-5024

Exploit Title: PLANNO 23.04.04 COMMENT CROSS SITE SCRIPTING Exploit Author: Angel Metz AKA PH03N1XSP Vendor Homepage: Planno Software Link: GitHub - PlanningBiblio Version: alert1; 4. 스크립트를 입력한 후, 반사형 XSS를 확인합니다. 두 번째 경로 1. 자격 증명을 사용하여 로그인합니다. 2. 오른쪽 상단으로 이동하여 "Enregistrer comme modele"을 클릭합니다. 3...

Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-

Criando um Ambiente Docker Vulnerável - CVE-2023-30212- Baixe os arquivos do meu repositório usando git clone git clone https://github.com/JasaluRah/Creating-a-Vulnerable-Docker-Environment-CVE-2023-30212-.git agora para configurar a imagem docker Criando a imagem docker use o comando sudo docker...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — PoC de XSS Refletido no STIG Manager OIDC Prova de Conceito conceitual para a vulnerabilidade de Cross-Site Scripting XSS refletido no STIG Manager versões 1.5.10 até 1.6.7. Resumo da Vulnerabilidade Existe uma vulnerabilidade de XSS refletido no código de tratamento de erros de...