XSSFire

XSSFire スタンドアロンのBlind XSSスクリプトです。 仕組み: このスクリプトはPHPとJavaScriptの組み合わせです。JSを使ってデータをキャプチャし、スクリプト自身に送信します。その後、レポートファイルを生成し、Telegramを通じて配信します。 要件: 1. ドメインとSSL証明書を備えたLinux上で動作するWebサーバー。 2. Telegramアカウント（BXSSレポートを受け取るため） なぜTelegramなのか? セットアップが簡単。 高速。 アクセスしやすい。 特徴: 1. キャプチャ対象: IP、User-Agent、日時、Local...

CVE-2025-34157

Coolify 삭제 흐름에서의 저장형 XSS CVE-2025-34157 영향 받는 버전: Coolify ≤ v4.0.0-beta.420.6 수정된 버전: v4.0.0-beta.420.7 심각도: 심각 9.4 CVSS 4.0 벡터: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 크로스 사이트 스크립팅, CWE-20 부적절한 입력 검증 요약 프로젝트 삭제 흐름의 저장형 XSS를 통해, 낮은 권한의 사용자가 만든 프로젝트를 관리자가 삭제하려고 ...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB 認証バイパス シンプルなPoC認証バイパスです。ブラウザ経由でアクセスしたい場合は、スクリプト内の USERAGENT 変数を、お使いのブラウザに表示されているものに合わせて変更するのを忘れないでください。Cookieエディタを使用して sid と u の値を置き換えてください。 影響を受けるバージョン: phpBB 3.3.16 以下 + 4.0.0-a2 root@kitploit: phpbb python3 exploit.py https://localhost:8000 joushk + Target:...

CVE-2022-3949

CVE-2022-3949 Simple Cashiering System における XSS Simple Cashiering System はクロスサイトスクリプティング（XSS）に対して脆弱です。悪意のある攻撃者は、侵害したユーザーの fullname を XSS ペイロードに変更でき、管理者がユーザータブまたは売上タブ（悪意のある攻撃者が行った売上を確認する場合）を訪れると、ペイロードが発動します。cookie に HttpOnly フラグがないため、これによりセッションの乗っ取りにつながる可能性があります。 再現手順:...

CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment Beat XP VEGA Smartwatch펌웨어 RB303ATV006229의 보안 평가는 Bluetooth Low EnergyBLE 연결에 중점을 두었으며, 인증 또는 세션 접근 제어 없이 근처의 BLE 중앙 장치가 단일 사용 가능한 BLE 세션을 설정하고 유지할 수 있게 하는 설계 및 구현 취약점을 드러냈습니다. 이 취약점에 대한 개념 증명PoC은 첨부된 PDF에 문서화되어 있으며, 원래 해당 조직의 내부 보안 검토를...

CVE-2026-23550

root@kitploit: ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗...

CVE-2026-66917

JoomGalleryのオブジェクトレベル認可の欠陥によるIDOR + 保存型XSS JoomGallery ≤ 4.3.0 — 編集者ロールのユーザーが任意のギャラリー画像をハイジャックし、XSSペイロードを保存することで、管理者セッションの乗っ取りを可能にする 概要 JoomGalleryのUserimageController::saveは、checkACL'edit.own', ...ではなくcheckACL'edit',...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

EUVD-2026-64226

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-73332

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-73332

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

EUVD-2026-57412

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-73332 CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-73332

CamaleonCMS: stored XSS in the cama_contact_form plugin via the before_html field. Low-privileged authenticated attackers can submit unsanitized content, persist payloads in the DB, and execute scripts in victims’ browsers when the contact form loads, enabling cookie theft, forged admin requests,...

CVE-2026-66885

Livebook CVE-2026-66885 is a CSRF weakness in the Livebook Teams identity callback. When configured for Livebook Teams, the OAuth-style callback does not bind to the initiating browser session (no state/nonce, auth request body empty). The code parameter is exchanged for an access token and writt...

CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

GHSA-PWXH-7358-JQ2X Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

CVE-2026-70482

Open WebUI (self-hosted AI platform) versions 0.8.0–0.11.0 are affected. When ENABLE_OAUTH_TOKEN_EXCHANGE is true, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it via the provider’s userinfo endpoint without confirming which OAuth client issued the token. As ...

CVE-2026-14557

The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID...