Roundcube-CVE-2024-42008-POC

CVE-2024-42008 Exploit XSS RoundCube Aperçu Ce dépôt contient un exploit de preuve de concept pour CVE-2024-42008 , une vulnérabilité de type Cross-Site Scripting XSS dans l'application webmail RoundCube. Cet exploit est conçu à des fins éducatives et pour des environnements de test d'intrusion...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 vulnérabilité XSS dans SiteLookup.do Description de l'information : Un problème a été découvert dans Zoho ManageEngine ServiceDesk Plus 9.3. Il y a une XSS via le paramètre qcsiteID de SiteLookup.do. Auteur : Concobe de Tarantula Team - VinCSS...

CVE-2024-24135

CVE-2024-24135: جرد المنتجات مع التصدير إلى إكسل - Cross-Site-Scripting إثبات المفهوم PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24135.md إثبات المفهوم PoC : https://github.com/BurakSevben/CVE-2024-24135/blob/main/CVE-2024-24135.md...

CVE-2026-94378 SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

POC_CVE-2024-40492

CVE-2024-40492 : XSS stocké menant à ATO Description Le Cross-Site Scripting stocké XSS est un type de vulnérabilité de sécurité généralement présent dans les applications web. Il se produit lorsqu'un attaquant parvient à injecter des scripts malveillants dans une application web et que ces scrip...

rConfig 3.9.4 - Cross-Site Scripting

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in...

lua_CVE-2020-24370

Lua 5.3 readme blockquote, .display border: solid a0a0a0 2px ; border-radius: 8px ; padding: 1em ; margin: 0px ; .display word-spacing: 0.25em ; dl.display dd padding-bottom: 0.2em ; tt, kbd, code font-size: 12pt ; مرحباً بك في Lua 5.3 حول · تثبيت · تغييرات · ترخيص · دليل المرجع حول Lua Lua هي لغ...

EUVD-2026-91853

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

EUVD-2026-91851

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

Cross-site Scripting (XSS)

Overview showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the makehtml.image and makehtml.link sub-parsers, when processing inline links or images whose angle-bracket destination URL contains a double-quote...

CVE-2026-104479

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479: Improper Neutralization of Input During Web Page Generation

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

PT-2026-104577

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 XSS إلى RCE، Wonder CMS 3.2.0 = 3.4.2 الاستخدام ➜ CVE-2023-41425 python3 exploit.py Enter target URL RHOST, e.g., http://example.com/loginURL: http://redacted.com/loginURL Enter your local host IP LHOST, e.g., 10.10.14.xxx: xx.xx.xx.xx Enter your local web server por...

CVE-2026-104479

Versions of Shopclass prior to 6.2.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. When the frontend TinyMCE is enabled, self-registered non-admin users can inject malicious JavaScript into item listing descriptions. The root cause is that the ItemActions.php component save...

weaponised-XSS-payloads

Payloads XSS armés Des payloads XSS conçus pour transformer alert1 en P1. L'article de blog Ce dépôt a été publié en même temps qu'un article de blog intitulé « How to Upgrade Your XSS Bugs from Medium to Critical » https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4...

CVE-2025-49844

🚨 CVE-2025-49844 — “RediShell” تنفيذ تعليمات برمجية عن بُعد خطير في أسرع مخزن بيانات في الذاكرة أصبحت برمجة Lua في Redis الآن منصة انطلاق مثالية بعد المصادقة. مهاجم موثَّق ← سكربت Lua مصمَّم ← هروب من الصندوق الرملي ← تنفيذ أوامر كامل على المضيف ⚠️ نظرة عامة CVE-2025-49844 "RediShell " هي ثغرة...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.4 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin ProfilePress versions = 4.17.4...