8800 matches found
rejjeto_hfs-rce-exploit-cve-2014-6287
HFS Remote Command Execution Exploit CVE-2014-6287 This is a Python 3 rewrite of the classic Remote Command Execution RCE exploit targeting Rejetto HTTP File Server HFS v2.3.x , leveraging the vulnerability identified as CVE-2014-6287. Originally discovered by Avinash Kumar Thapa aka "-Acid" , th...
CVE-2022-35914
CVE-2022-35914 PoC References https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc Credit to SΓ©bastien Copin for the PoC I adapted here Check out my full writeup here: https://link.medium.com/tBwDlpQl3Ib Usage pip install -r...
CVE-2022-32132
CVE-2022-32132 for osTicket | Support Ticketing System Reflected XSS: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...
CVE-2025-25612
CVE-2025-25612: FS S3150-8T2F Switch Stored Cross Site Scripting XSS CVE-2025-25612 FS Inc S3150-8T2F prior to version S3150-8T2F2.2.0D135103 is vulnerable to Cross Site Scripting XSS in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious...
CVE-2024-20405
Description A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP...
CVE-2026-51990
cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. β€οΈ α‘α % ααααΆαααα·α αα αΆαααααα’ααα ααΉαααααΌαααΆαααα·α αα αΆαααΌααααααΈαααααααααααα»ααααΆα β€οΈ Ten percent of every donation is contributed to Kantha Bopha...
CVE-2026-84369
A flaw was found in SVGO, a tool designed to optimize SVG Scalable Vector Graphics files. The removeScripts feature, which is meant to remove potentially harmful code, fails to fully sanitize executable HTML content embedded within SVG foreignObject elements. This oversight could allow a remote...
OpenNebula-CVE-2025-56537
OpenNebula-CVE-2025-56537 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in virtual network template Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix : Upgrade...
OpenNebula-CVE-2025-56535
OpenNebula-CVE-2025-56535 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in zone attribute Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix : Upgrade to...
CVE-2026-67401
cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. β€οΈ α‘α % ααααΆαααα·α αα αΆαααααα’ααα ααΉαααααΌαααΆαααα·α αα αΆαααΌααααααΈαααααααααααα»ααααΆα β€οΈ Ten percent of every donation is contributed to Kantha Bopha...
CVE-2026-111168
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/uuid serves it inlin...
gitbook-xss
gitbook-xss CVE-2019-19596 GitBook through 2.6.9 allows XSS via a local .md file By entering script in MD file, it can be executed by gitbook...
CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...
CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...
OpenNebula-CVE-2025-56534
OpenNebula-CVE-2025-56534 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in the custom authenticator driver Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix :...
CVE-2021-20717
CVE-2021-20717-EC-CUBE-XSS NVD Description Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script...
CVE-2025-56762
Description: The application leverages βerror.phpβ to serve the respective error code as per the use case back to the web application upon encountering an error. Upon inspecting the source code, it was found that the application does not sanitize the parameter βcodeβ when crafting a malicious...
CVE-2021-36747
CVE-2021-36747 Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. Discovered: May 11th, 2018 The Blackboard Security Team has been notified of this issue. They acknowledged the vulnerability on May 14, 2018. Description: The Blackboard tool commonly...
CVE-2024-39248
Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Exploit Author: Jason Jacobs 0xjasonjacobs - Twitter Vendor Homepage: https://sourceforge.net/projects/simpcms/ Vulnerable endpoint: /SimpCMS/admin.php A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows...
PYSEC-2026-4270 PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...