GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

CVE-2023-34632

CVE-2023-34632 Отражённый XSS в 1000projects Book Management System 1.0 CVE-2023-34632 Отражённая межсайтовая скриптовка XSS в 1000projects Book Management System 1.0 Описание Отражённая уязвимость межсайтовой скриптовки XSS была обнаружена в 1000projects Book Management System версии 1.0...

PT-2026-104144

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the...

PT-2026-104142

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-104148

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-104081

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.15.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping during Paragraph Text field submissions...

PT-2026-104079

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

PT-2026-104143

Name of the Vulnerable Software and Affected Versions The Newsletter – Send awesome emails from WordPress versions prior to 9.4.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious...

PT-2026-104119

Name of the Vulnerable Software and Affected Versions CMB2 versions prior to 2.13.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By exploiting the parameter such as kl code or kl post code, an attacker can...

PT-2026-104153

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search versions prior to 4.28.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. This enables the injection of...

PT-2026-104141

Name of the Vulnerable Software and Affected Versions No External Links versions prior to 5.2.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

CVE-2025-8550

CVE-2025-8550 – atjiu pybbs XSS Exploit Description This repository hosts an automated Proof-of-Concept PoC exploit for CVE-2025-8550 , a reflected Cross‑Site Scripting XSS vulnerability in atjiu pybbs ≤ v6.0.0. It targets the /admin/topic/list endpoint’s username parameter, which lacks proper...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Уязвимость отражённого межсайтового скриптинга XSS в Tiki CMS Tiki CMS - уязвимость отражённого межсайтового скриптинга XSS в параметре 'page' Отказ от ответственности Предназначено только для образовательных, исследовательских и защитных целей. Несанкционированное использование...

CVE-2025-25296

CVE-2025-25296 Доказательство концепции POC Описание Этот проект демонстрирует доказательство концепции POC для уязвимости CVE-2025-25296, затрагивающей Label Studio, инструмент разметки данных с открытым исходным кодом. Уязвимость находится в конечной точке /projects/upload-example, которая не...

CVE-2025-3248

Technical Analysis & Defensive Guide: CVE-2025-3248 Langflow Code Injection An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow. 📌 Vulnerability Profile CVE ID: CVE-2025-3248 Vulnerability Type: Remote Code Execution RCE /...

CVE-2018-16763_fuel_cms_exploit

⚠️ Дисклеймер Этот проект предназначен строго для образовательных и этических целей исследования безопасности. Все действия выполнялись в контролируемой лабораторной / CTF-среде. Не используйте описанные здесь методы на любой системе без соответствующего разрешения. 🎯 Цели Выявить потенциальные...

CVE-2024-46879-TikiCMS-XSS

CVE-2024-46879 - Vulnérabilité de Cross-Site Scripting XSS réfléchi dans Tiki CMS Tiki CMS - Vulnérabilité de Cross-Site Scripting XSS réfléchi dans le paramètre 'zipPath' Avertissement Destiné uniquement à des fins éducatives, de recherche et défensives. Toute utilisation non autorisée contre de...

CVE-2025-56799

CVE-2025-56799 Уязвимость внедрения OS-команд через планировщик очистки кэша в настольном приложении Reolink 1. Обзор Название : Настольное приложение Reolink Версия : 8.18.12 Производитель : Reolink CWE : CWE-78: Некорректная нейтрализация специальных элементов, используемых в OS-команде...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

CVE-2024-41713-Scan

CVE-2024-41713 스캐너 이 저장소에는 Apache HTTP Server에서 CVE-2024-41713 취약점의 존재를 탐지하는 Python 스크립트가 포함되어 있습니다. CVE-2024-41713은 디렉터리 트래버설 취약점으로, 인증되지 않은 공격자가 취약한 서버의 제한된 리소스에 접근할 수 있게 합니다. CVE-2024-41713 정보 이 취약점은 사용자가 제공한 경로의 부적절한 검증으로 인해 발생합니다. 공격자는 악의적인 요청을 구성하여 디렉터리를 탐색하고 민감한 파일이나 백엔드 서비스에 접근함으로써 이를 악용할...