CVE-2026-22849

CVE-2026-22849: Saleor carece de una sanitización adecuada de HTML en los campos de texto enriquecido Resumen...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus vulnerable to Remote Code Execution RCE due to improper input sanitization Overview CVE-2024-21534 is a critical vulnerability found in versions of the jsonpath-plus package prior to version 10.0.0. The vulnerability stems from improper input sanitization, which...

CVE-2024-42009

CVE-2024-42009 – XSS Almacenado en Roundcube PoC Docker 📌 Descripción General Este repositorio demuestra una Prueba de Concepto PoC funcional para CVE-2024-42009 , una vulnerabilidad de Cross-Site Scripting XSS almacenado en Roundcube Webmail. La vulnerabilidad es causada por una sanitización HTM...

CVE-2021-21315-PoC

CVE-2021-21315-systeminformation This is Proof of Concept for CVE-2021-21315 which affects The System Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation "be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite,...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Lab Setup root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000 Description Versions of the...

EUVD-2026-74001

In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45525

CVE-2026-45525 affects Android , where a logic error in multiple locations causes improper data sanitization . This can lead to local information disclosure without requiring additional execution privileges, and no user interaction is needed for exploitation. The vulnerability is tracked in the A...

EUVD-2026-73979

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28638

CVE-2026-28638 is a High -severity vulnerability in Android's XmpDataParser.java , part of the media framework. It stems from improper data sanitization due to a logic error , which can lead to local information disclosure without requiring additional execution privileges or user interaction. The...

CVE-2023-30547

CVE-2023-30547 vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException which can be used to esca...

cuFuzz

cuFuzz This repository contains the artifacts for cuFuzz , a GPU-oriented coverage-guided fuzzer for userland CUDA applications. cuFuzz combines host-side and device-side coverage collection with sanitization to effectively discover bugs in CUDA programs. Repository Structure root@kitploit:...

CVE-2024-48910-POC

CVE-2024-48910 Proof of Concept This is a proof of concept for CVE-2024-48910. This is a vulnerability that was present in DOMPurify, an XSS sanitizer for HTML, SVG, and MathML. This version of DOMPurify is vulnerable to prototype pollution, where an atatcker can inject properties into any JS...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...

morty

Morty 作为服务的Web内容净化代理 Morty 重写网页以排除恶意 HTML 标签和属性。它还会替换外部资源引用以防止第三方信息泄露。 Morty 的主要目标是作为 searx 的结果代理提供，但它也可以作为独立的净化服务使用。 特性： HTML 净化 将 HTML/CSS 外部引用重写为本地引用 阻止 JavaScript 不转发 Cookie 不发送 Referer 无缓存/ETag 支持 GET/POST 表单和 IFrame 可选的 HMAC URL 验证密钥以防止服务滥用 安装和设置 要求：Go 版本 1.10 或更高。 root@kitploit: $ go get...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2025-28074

CVE-2025-28074 Suggested description phpList prior to 3.6.3 is vulnerable to Cross-Site Scripting XSS due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing ...

CVE-2026-27886

CVE-2026-27886 PoC de Strapi Solo para pruebas de seguridad autorizadas. Strapi filtra datos sensibles mediante filtrado relacional debido a la falta de saneamiento de consultas. Incluye: CVE-2026-27886.py - PoC en Python CVE-2026-27886.yaml - plantilla de Nuclei para detección Qué comprueba El...

Webapp_Pentast

CVE-2022-31147 Proof of Concept & Manual Testing Guide This guide provides comprehensive methodologies for testing CVE-2022-31147, a critical path traversal vulnerability affecting the widely used matthiasmullie/minify library. The vulnerability allows attackers to exploit insufficient input...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...