CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

shlol

SHLOL This is a menu you can trigger with a keybind to do basic stuff for you Really easy to use Create listeners on the fly No copy pasting needed Choose the type, IP and PORT and you are done! Run remote scripts easily Reverse Shell Generator...

CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

CVE-2026-51990

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.78 packages and security update

Red Hat OpenShift Container Platform release 4.14.78 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Malicious code in logger-libs (PyPI)

Source: kam193 b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55 In this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious code from a remote location. --- Category: MALICIOUS - The...

Malicious code in logger-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b The package publishes under a name resembling the legitimate log-utils/loggerutil library README imports loggerutil.helper, setup.py url points at...

MAL-2026-18778 Malicious code in logger-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7ca01d22004220ca07b3bc1ccd0e735f150bad7ce18f1539a90a88687f447b The package publishes under a name resembling the legitimate log-utils/loggerutil library README imports loggerutil.helper, setup.py url points at...

Malicious code in twitch-stream-py (PyPI)

Source: kam193 bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c Clone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer accessible. The campaign was originally discovered by...

Malicious code in twitch-stream-py (PyPI)

twitchstream/getchat.py is a modified copy of the sounddevice library. Its queryhostapis function, which other functions in the module call, decodes a base32-hidden URL, downloads a Python script from it to %USERPROFILE%.steam\script.py, adds a value named "WindowsUpdate" under...

MAL-2026-18756 Malicious code in twitch-stream-py (PyPI)

twitchstream/getchat.py is a modified copy of the sounddevice library. Its queryhostapis function, which other functions in the module call, decodes a base32-hidden URL, downloads a Python script from it to %USERPROFILE%.steam\script.py, adds a value named "WindowsUpdate" under...

CVE-2026-120636

A flaw was found in perl-cgi. The component constructs target URLs and form actions from client-supplied request values without sufficient validation. A remote attacker can exploit this flaw by sending a specially crafted request URI Uniform Resource Identifier containing arbitrary domains or...

MAL-2026-18405 Malicious code in log-utils-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e04ec7e9e18068a3876db982defaaa4710d22d8bf619e65f6976b8cf7ddd3e9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in jobwharf (PyPI)

Source: kam193 172e672abed0eeea77b62d2a9dea9999b59ff685b952fec68c70e2b227e0bce6 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in larchworker (PyPI)

Source: kam193 87e174c9dc2485263894e4d6c3d1560589659afbfbe9397ca1e1b53fb21d96b3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in slatejob (PyPI)

Source: kam193 779bcb94eecf53cfda39d7bfeb12aac9de072d14b22904a6f7bf55e33c3e5e7f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...