CVE-2022-2546

All-in-One WP Migration Versions affectées All-in-One WP Migration 7.63 Référence...

CVE-2025-0133-exploit

Сканирование CVE-2025-0133 Скрипт, написанный на Python, предназначенный для проверки наличия уязвимости отражённого межсайтового скриптинга Reflected Cross-Site Scripting CVE-2025-0133, которая возникает в Palo Alto. Файл getconfig.esp обнаруживается и проверяется на XSS с помощью данного скрипт...

WordPress WPC Estimated Delivery Date for WooCommerce plugin <= 4.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPC Estimated Delivery Date for WooCommerce versions = 4.0.1...

CVE-2026-5782

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress: отражённый XSS до аутентификации → цепочка удалённого выполнения кода DOM Clobbering + кража пароля приложения + активация плагина через REST API = полный RCE ⚡ Обзор CVE-2026-64638 — это критическая отражённая XSS до аутентификации в wp-login.php WordPress...

CVE-2026-5782 Reflected XSS in MRV Technology's TurkHotspot

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not...

EUVD-2026-91649

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Loglama.net TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-5782

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Loglama.net TurkHotspot due to the improper neutralization of input during web page generation. This vulnerability allows an attacker to execute scripts in a victim's browser. The issue affects versions of TurkHotspot through 2026-10-...

CVE-2026-5782 Reflected XSS in MRV Technology's TurkHotspot

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not...

CVE-2025-12101-Scanner-PoC

Scanner CVE-2025-12101 Scanner de vulnérabilité multi-threadé pour CVE-2025-12101 - XSS Citrix NetScaler via SAML RelayState. Aperçu CVE-2025-12101 est une vulnérabilité XSS reflétée dans les produits Citrix NetScaler ADC et Gateway affectant le point de terminaison /cgi/logout via le paramètre...

CVE-2025-6563

Консультация по отражённой XSS-уязвимости на странице входа в Hotspot MikroTik Обзор На странице входа в Hotspot MikroTik RouterOS была обнаружена отражённая уязвимость межсайтового скриптинга Cross-Site Scripting, XSS. Уязвимость срабатывает через URL-параметр dst, который некорректно санитизиру...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

CVE-2026-64638-PoC-Exploit

🌀 CVE‑2026‑64638 – WordPress XSS2Shell: комплекс безопасности ⚠️ ТОЛЬКО ДЛЯ ЭТИЧНОГО ИСПОЛЬЗОВАНИЯ – АВТОРИЗОВАННОЕ ТЕСТИРОВАНИЕ БЕЗОПАСНОСТИ Данный репозиторий предоставляет инструменты только для авторизованных специалистов по безопасности, blue team и пентестеров. Несанкционированный доступ к...

CVE-2026-104473

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104465

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-64638

CVE-2026-64638 Отражённый XSS на экране входа, ведущий к выполнению PHP-кода — WordPress Core Программное обеспечение: WordPress Core ≤ 7.0.2 все версии до 7.0.3 CVSS: 8.9 Высокий CWE: CWE-79 — Некорректная нейтрализация ввода при генерации веб-страницы Требуется аутентификация: Не требуется до...

CVE-2026-64638-POC

CVE-2026-64638 — XSS2Shell Предварительно аутентифицированный отражённый XSS → удалённое выполнение кода в ядре WordPress ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ: Данный репозиторий предназначен только для авторизованных исследований в области безопасности и образовательных целей. Не используйте его против...

CVE-2026-104473

Versions of YesWiki before 4.5.3 are susceptible to multiple reflected cross-site scripting (XSS) vulnerabilities. The root cause is the failure to sanitize several input parameters, specifically incomingurl , id , file , tags , and template . A remote attacker can leverage these flaws by luring ...

CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...