xss_vulnerability_challenges

Escenarios de Vulnerabilidad XSS desafíos Este repositorio es una aplicación PHP Dockerizada que contiene algunos desafíos de vulnerabilidad XSS. Las ideas detrás de los desafíos son: Bypass de validación de JavaScript Bypass de entidades HTML Bypass de WAF Bypass de validación de lista negra...

Bashark

Bashark 2.0 Kit de post-explotación Bashark ayuda a pentesters e investigadores de seguridad durante la fase de post-explotación de una auditoría de seguridad. Uso Para lanzar esta herramienta en un host comprometido, simplemente ejecute source el script bashark.sh desde la terminal: $ source...

XSS-Payloads

This repository does not have a README...

CVE-2026-101141

A cross-site scripting (XSS) vulnerability exists in Eleveo Call Recording Software 9.7.0 within the Play Audio Page component. The flaw is located in an unknown function of the file /callrec/audio.jsp , where an attacker can remotely manipulate the viewRoleId/cfType argument to execute the attac...

EUVD-2026-88446

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The...

turbo-intruder

Turbo Intruder Turbo Intruder es una extensión de Burp Suite para enviar grandes cantidades de solicitudes HTTP y analizar los resultados. Está diseñado para complementar a Burp Intruder manejando ataques que requieren velocidad, duración o complejidad excepcionales. Las siguientes característica...

evilrdp

🚩 Patrocinadores Si te gusta este proyecto, ¡considera patrocinarlo en GitHub! Patrocinadores EVILRDP - Más control sobre RDP El gemelo malvado de aardwolfgui que utiliza la biblioteca cliente RDP aardwolf y te brinda control extendido sobre el objetivo y capacidades adicionales de scripting desd...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "tname" parameter on "newterm" Description : A cross-site scripting XSS vulnerability in the component “newterm” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or...

nmap-nse-vulnerability-scripts

NMAP vulnerability scanning scripts A collection of nmap vulnerability scanning scripts to aid afforable detection and remediation. Background These scripts use the Nmap Scripting Engine NSE to implement checks for various vulnerabilities. References: https://nmap.org/book/man-nse.html...

CVE-2023-27350

CVE-2023-27350 POC for CVE-2023-27350 affecting PaperCut MF/NG Technical Analysis A technical root cause analysis of the vulnerability, indicators of compromise, and internet exposure can be found on our blog: https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

Unauthenticated Stored Cross-Site Scripting XSS in genai/evalsvisualization.py of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 - github.com/googleapis/python-aiplatform Author: Joshua Provoste N-day Researcher & Dev Credits: Din Asotić...

CVE-2023-34840

CVE-2023-34840 Vulnerability Explanation All versions in angular-ui-notification are vulnerable to XSS due to the library not sanitizing the input provided by the user. In order to safely use this library, sanitizing / encoding the parameters passed to this library is highly recommended, such as...

Security Bulletin: Multiple vulnerabilities within WebSphere Application Server, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within WebSphere Application Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to...

EUVD-2026-88439

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

CVE-2026-101111

The Joomla Extension - ordasoft.com - Book Library (Free) version

CVE-2026-101109

The Joomla Extension - ordasoft.com - Vehicle Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.5.8 . The root cause is that the public vehicle-detail page (triggered by task=view) echoes the title request parameter directly into a double-quoted HTML attr...

EUVD-2026-88437

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...

CVE-2023-49986

CVE-2023-49986 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" parameter on "addnewparent" Description : A cross-site scripting XSS vulnerability in the component “addnewparent” of School Fees Management System 1.0 allow attackers to execute arbitrary web...