CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment A security assessment of the Beat XP VEGA Smartwatch Firmware RB303ATV006229 focused on Bluetooth Low Energy BLE connectivity revealed a design and implementation weakness that enables a nearby BLE central device to establish and retain...

CVE-2022-3949

CVE-2022-3949 XSS in Simple Cashiering System Simple Cashiering System is vulnerable to Cross Site Scripting XSS - a malicious actor can change the fullname of a compromised user to a XSS Payload and whenever a admin visits the user-tab or the sales tab and looks into sales made by the malicious...

CVE-2026-23550

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗ ███████╗██║██╔██║ ██║ ╚█...

XSSFire

XSSFire A standalone Blind XSS Script. How it works: The script is a combination between PHP and JavaScript, it captures the data using JS and send it to the script itself, then it generates report files and deliver them through telegram. Requirements: 1. Web Server running on Linux with a domain...

CVE-2025-59848

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59847

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

EUVD-2025-211310

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59847

HCL Domino Leap is vulnerable to Stored XSS via malicious application titles within the Manage page dialogs . This vulnerability allows an attacker to perform a session takeover of a user. The impact is categorized as Medium severity, requiring high privileges and user interaction. No specific ex...

CVE-2025-59848 HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59848

HCL Leap is vulnerable to Stored Cross-Site Scripting (XSS) caused by the improper neutralization of input during web page generation. Specifically, malicious application titles within the Manage page dialogs can be exploited. This vulnerability could allow an attacker to take over a user's sessi...

EUVD-2025-211309

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59847: HCL Software HCL Domino Leap: HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an…

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2025-59848: HCL Software HCL Leap: HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an…

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session...

CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover SUMMARY UserimageController::save in JoomGallery checks checkACL'edit', ... instead of checkACL'edit.own'...

cve-2026-100671-poc

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal, target-scoped attacker-side verifier for the Grav content-Twig/page-cache session takeover fixed in Grav 2.0.25. Advisories: CVE-2026-100671 GHSA-pp89-h475-7gj6 Grav 2.0.25 release Important: no administrator credential The attacker...

CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

CVE-2025-34157

Stored XSS in Coolify delete flow CVE-2025-34157 Affects: Coolify ≤ v4.0.0-beta.420.6 Fixed in: v4.0.0-beta.420.7 Severity: Critical 9.4 CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 Improper Input Validation Summary A...

CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

CVE-2021-32099

CVE-2021-32099 pandora fms 742 sqli pre authentication POC http://localhost/pandoraconsole/include/chartgenerator.php?sessionid=a' UNION SELECT 'a',1,'idusuario|s:5:"admin";' as data FROM tsessionsphp WHERE '1'='1 URL Encoded...

CVE-2026-58490

Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAMLSIGNEDASSERTIONS and SAMLSIGNEDRESPONSES as empty values, overriding secure application defaults and disabling both...