CVE-2022-42889-text4shell

CVE-2022-42889 alias text4shell PoC pour la vulnérabilité récemment découverte dans Apache Commons Text par @pwntester : Comme mentionné dans https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/ : La vulnérabilité réside dans l'objet interpolateur...

CVE-2022-32132

CVE-2022-32132 для osTicket | Система поддержки тикетов Отражённый XSS: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...

CVE-2019-1218

CVE-2019-1218 Vulnérabilité de Spoofing dans Outlook iOS J'ai découvert une XSS dans l'application mobile Outlook iOS. Une grave vulnérabilité dans Microsoft Outlook pour iOS qui pourrait permettre à un attaquant de prendre le contrôle de l'appareil d'une victime. Ce problème de sécurité pourrait...

CVE-2025-25612

CVE-2025-25612: FS S3150-8T2F 스위치 저장형 크로스 사이트 스크립팅 XSS CVE-2025-25612 FS Inc S3150-8T2F 버전 S3150-8T2F2.2.0D135103 이전은 관리 인터페이스의 Time Range Configuration 기능에서 크로스 사이트 스크립팅XSS에 취약합니다. 공격자는 적절히 검증되지 않은 "Time Range Name" 필드에 악성 JavaScript를 주입할 수 있습니다. 이 입력이 저장되면 나중에 영향을 받는 페이지에 접근하는 모든 사용자관리자 포함의...

CVE-2024-22120-RCE

CVE-2024-22120 Boîte à outils Versions affectées 6.0.0 - 6.0.27 6.4.0 - 6.4.12 7.0.0alpha1 Crédit https://x.com/mf0cuz https://support.zabbix.com/browse/ZBX-24505 https://packetstormsecurity.com/files/137454/Zabbix-3.0.3-Remote-Command-Execution.html Prérequis un utilisateur à faibles privilèges...

CVE-2023-38831-winrar-exploit

CVE-2023-38831 générateur d'exploit winrar Test POC rapide Générer le POC par défaut pour le test python cve-2023-38831-exp-gen.py poc or python cve-2023-38831-exp-gen.py CLASSIFIEDDOCUMENTS.pdf script.bat poc.rar Personnalisé 1. Placez le fichier appât et le script malveillant dans le répertoire...

NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting

NextGEN Gallery through 4.2.3 reflects a URL-decoded nggtag route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an svg onload payload...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

CVE-2023-38831

CVE-2023-38831 Exploit - Générateur d'archive Appât et Changement Vue d'ensemble Ce script Python est conçu pour générer un fichier d'archive de type « appât et changement ». Il est destiné uniquement à des fins éducatives et de piratage éthique. Veuillez vous assurer d'avoir les autorisations...

XcInspector

XcInspector: Xcode 프로젝트 보안을 위한 도구 XcInspector는 Xcode 프로젝트 파일에서 발생할 수 있는 보안 문제를 스캔하기 위한 macOS 앱이자 명령줄 도구입니다. GitLab의 소스 코드 저장소 계획된 검사규칙 목록 왜 필요한가? Xcode 프로젝트가 보안과 프라이버시를 침해하는 데 악용될 수 있는 몇 가지 방법이 있습니다. 프로젝트에 임의의 스크립트를 삽입할 수 있으며, 특정 작업예: 일반적인 “Build” 명령이 발생할 때 자동으로 실행되도록 설정할 수 있습니다. 스크립트가 프로젝트 디렉터리...

shlol

SHLOL Ceci est un menu que vous pouvez déclencher avec un raccourci clavier pour effectuer des tâches de base pour vous Très facile à utiliser Créez des écouteurs à la volée Pas besoin de copier-coller Choisissez le type, l'IP et le PORT et c'est fait ! Exécutez facilement des scripts distants...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2020-10204

CVE-2020-10204 CVE-2020-10204 скрипт удаленного выполнения команд Ещё скрипты см.: https://github.com/zhzyker/exphub Readme +---------------------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + +...

CVE-2024-20405

Description Une vulnérabilité dans l'interface de gestion basée sur le web de Cisco Finesse pourrait permettre à un attaquant distant non authentifié de mener une attaque XSS stockée en exploitant une vulnérabilité RFI. Cette vulnérabilité est due à une validation insuffisante des entrées fournie...

CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS Описание NVD Уязвимость межсайтового скриптинга XSS в EC-CUBE с 4.0.0 по 4.0.5 позволяет удаленному злоумышленнику внедрить специально созданный скрипт в определенное поле ввода сайта электронной коммерции, созданного с помощью EC-CUBE. В результате это может привести к...