CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2022-35497

In Trimble's TM4WEB =22.2.0 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint. Specifically, the three cookies used for maintaining sessions are UID, rstring...

CVE-2026-19872

A flaw was found in HTML::FormHandler. A remote attacker could exploit this vulnerability by submitting malicious input that is then rendered unescaped in error messages. This allows the attacker to execute arbitrary script code in the victim's browser, potentially leading to information disclosu...

CVE-2026-82019

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

EUVD-2026-77522

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage

TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...

CVE-2023-0264

CVE-2023-0264 的 PoC Keycloak 漏洞，允许在授权码流程期间进行会话劫持 参见 https://github.com/advisories/GHSA-9g98-5mj6-f9mv 先决条件 Docker curl jq python3 或另一个用于在 HTTP 上提供静态文件的工具 复现步骤 1. 使用 ./run-keycloak-container.sh 启动 Keycloak 容器 2. 使用 ./create-users.sh 创建两个用户 alice 和 mallory 3. 从此仓库提供静态文件，例如 python3 -m http.server 80...

CVE-2026-90931

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

EUVD-2026-77449

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a hosts group using the configuration with XSS payload, which will be available to other users. When XSS is stored by an authenticated malicious actor, and other users attempt to search for groups during the creation of new hosts, the XSS payload will activate,...

CVE-2021-46067

CVE-2021-46067 Exploit 标题：车辆服务管理系统 - 多个 Cookie 窃取导致完全账户接管 Exploit 作者：SANU P.L CVE：CVE-2021-46067 CVSS：9.8 严重 参考资料： https://www.plsanu.com/vehicle-service-management-system-multiple-cookie-stealing-leads-to-full-account-takeover https://nvd.nist.gov/vuln/detail/CVE-2021-46067...

CVE-2026-37196

CVE-2026-37196 – nirix traq v3.9.0 中的存储型跨站脚本（XSS）漏洞 概述 在 nirix traq v3.9.0 中存在一个存储型跨站脚本（XSS）漏洞，用户在 工单描述字段中提供的输入在应用程序界面渲染前未得到正确清理。 该漏洞允许已认证的攻击者将恶意 JavaScript 载荷注入工单描述。该载荷会被应用程序存储，并在其他用户（包括管理员等特权用户）查看受影响的工单时间线或渲染组件时执行。 CVE ID： CVE-2026-37196 漏洞类型： 存储型跨站脚本（CWE-79） 厂商： nirix 产品： traq 受影响版本： 3.9.0 攻击类...

CVE-2025-55888

CVE-2025-55888 Description Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered,...

Termix-research

Termix 安全研究 针对 Termix 的漏洞研究，这是一个基于 Web 的 SSH 与服务器管理平台（13k+ stars）。 CVE| 问题| 严重性| 修复版本| 安全公告 ---|---|---|---|--- CVE-2026-45746| 会话劫持 → RCE| 9.0 严重| v2.3.2| GHSA-cx2r-843c-vww8 CVE-2026-45750| 操作系统命令注入| 9.0 严重| v2.3.2| GHSA-v26q-rpv5-9m72 CVE-2026-53547| 账户接管| 8.8 高危| v2.3.2| GHSA-6r97-7wp3-2g3x...

CVE-2025-14855-POC

CVE-2025-14855：SureForms WordPress 插件存储型 XSS 概念验证 目标： WordPress 插件“SureForms” 插件地址： https://wordpress.org/plugins/sureforms/ 漏洞类型： 存储型跨站脚本（XSS） CVE： CVE-2025-14855 参考：...

PT-2026-91207

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2025-67876

CVE-2025-67876：ChurchCRM 群组角色名称存储型 XSS 导致管理员会话劫持 概述 字段| 详情 ---|--- CVE ID| CVE-2025-67876 严重性| 严重 安全公告| 查看安全公告 发现者| Lukasz Rybak 受影响产品 ChurchCRM/CRM 详情 摘要 ChurchCRM 中存在存储型跨站脚本（XSS）漏洞，允许拥有“管理群组”权限的低权限用户在群组角色名称中注入持久化 JavaScript。该载荷保存在数据库中，当任何用户（包括管理员）访问显示该角色的页面（如 GroupView.php 或...

SSL VPN Session Hijacking

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. id: CVE-2024-53704 info: name: SSL VPN Session Hijacking author: johnk3r severity: critical description: | An Improper Authentication vulnerability in the SSLVPN...

CVE-2026-90443

CVE-2026-90443 is a reflected cross-site scripting (XSS) vulnerability in a web interface associated with an Operational Technology (OT) product, as indicated by its CISA ICS-CERT CSAF advisory reference. The root cause is that a portion of the request URL is reflected into a script context and a...