mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

CVE-2024-41713-Scan

CVE-2024-41713 스캐너 이 저장소에는 Apache HTTP Server에서 CVE-2024-41713 취약점의 존재를 탐지하는 Python 스크립트가 포함되어 있습니다. CVE-2024-41713은 디렉터리 트래버설 취약점으로, 인증되지 않은 공격자가 취약한 서버의 제한된 리소스에 접근할 수 있게 합니다. CVE-2024-41713 정보 이 취약점은 사용자가 제공한 경로의 부적절한 검증으로 인해 발생합니다. 공격자는 악의적인 요청을 구성하여 디렉터리를 탐색하고 민감한 파일이나 백엔드 서비스에 접근함으로써 이를 악용할...

CVE-2026-1844

PixelYourSite PRO - Unauthenticated Stored Cross-Site ScriptingCVE-2026-1844 Overview The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pyslandingpage' parameter in all versions up to, and including, 12.4.0.2 due ...

jsPDF-Object-Injection

CVE-2026-25755 Sandbox Bypassed jsPDF Flaw to Object Injection Overview A critical PDF Object Injection vulnerability CVE-2026-25755 was discovered in jsPDF, a widely-used JavaScript library for generating PDF documents in client-side applications. The vulnerability exists in the addJS function,...

CVE-2026-6227

CVE-2026-6227: Local File Inclusion in BackWPup Advisory Summary BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion LFI vulnerability via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The flaw was caused by non-recursive...

CVE-2025-55854-PoC

CVE-2025-55854 - Stored Cross-Site Scripting XSS Vulnerability Vulnerability Overview CVE ID: CVE-2025-55854 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: High Affected Component: User Profile Bio Field Affected Application: FreelanceHub https://github.com/nooncarlett/FreelanceHub...

CVE-2026-31908

CVE-2026-31908 - Apache APISIX Header Injection Exploit 📋 Overview This is a Proof of Concept PoC exploit for CVE-2026-31908 , a critical header injection vulnerability discovered in Apache APISIX versions 2.12.0 through 3.15.0. The vulnerability exists in the forward-auth plugin, where improper...

CVE-2026-2256-PoC

CVE-2026–2256 PoC Executive Summary A critical command injection vulnerability CVE-2026–2256, CVSS X.X was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shel...

CVE-2026-4112

SonicWall SMA 8200v: Privilege Escalation via Cross-Parameter Blind SQL Injection Firmware: 12.5.0-02283 Platform Hotfix on 12.5.0-02002 Base SonicWall Advisory 1. Summary A post-authentication blind SQL injection vulnerability in the SonicWall SMA 8200v management console port 8443 allows any...

CVE-2026-22849

CVE-2026-22849: Saleor lacks proper HTML sanitization in rich text fields Overview Field| Details ---|--- CVE ID| CVE-2026-22849 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products saleor/saleor Details Saleor was allowing users to modify rich text fields with HTM...

CVE-2026-103687

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

exploit_cve-2007-2447_again

exploitcve-2007-2447again just remeber how small mistake in santisize username could give yoy root access to the full machine...

EUVD-2026-90850

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-103687 rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-103687 rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-103687

A vulnerability exists in rhukster dom-sanitizer up to version 1.0.15 within the SVG Sanitization component. The flaw is located in the url function of the src/DOMSanitizer.php file, where manipulation can lead to an incomplete blacklist . This issue allows for potential remote attacks , and expl...

CVE-2023-29808

Exploit Title: Reflected Cross Site Scripting Google Dork: Date: 27.04.2023 Exploit Author: Lucas Noki 0xPrototype Vendor Homepage: https://github.com/vogtmh Software Link: https://github.com/vogtmh/cmaps Version: 8.0 Tested on: Mac, Windows, Linux CVE : CVE-2023-29808 Description: The...

CVE-2024-38793-PoC

CVE-2024-38793-PoC Код доказательства концепции для эксплуатации CVE-2024-38793 Best Restaurant Menu by PriceListo = 1.4.1 — аутентифицированная SQL-инъекция Contributor+. Доказательство концепции Это PoC-эксплойт для уязвимости CVE-2024-38793, SQL-инъекции в версиях плагина WordPress Best...

CVE-2026-96573

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CVE-2026-100184

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...