CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-105708

A flaw in the SVG Handler component of imgproxy (versions up to 4.0.17 ) allows for Cross-Site Scripting (XSS) . The vulnerability exists in the sanitizeElement function within the processing/svg/svg.go file. This flaw can be triggered via a remote manipulation attack. While the exploit has been ...

CVE-2026-105705

The SourceCodester Drug Recommendation System 1.0 is vulnerable to a Cross-Site Scripting (XSS) flaw via an unknown function in the Admin/add_drug.php file. This vulnerability allows for remote manipulation resulting in XSS. The documents indicate that an exploit has been released to the public a...

traxss

Traxss Automated Vulnerability Scanner for XSS | Written in Python3 | Utilizes Selenium Headless Forks DEMO Background Traxss is a Hacktoberfest Project! If you are looking for a place to make contribute, please feel free. Traxss is an automated framework to scan URLs and webpages for XSS...

sobelow

Sobelow Sobelow is a security-focused static analysis tool for Elixir & the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent the introduction of a number of common vulnerabilities...

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. ezXSS is a tool that is designed to help find and exploit cross-site scripting XSS vulnerabilities. One of the key features of ezXSS is its ability to identify and exploit blind XSS...

AwesomeXSS

AwesomeXSS This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue. Awesome contents Challenges Reads & Presentations Tools Mind maps DOM XSS Payloads Polyglots Tags and event handlers Context breaking HTML context Attribute context...

PwnXSS

A powerful XSS scanner made in python 3.7 Installing Requirements: BeautifulSoup4 pip install bs4 requests pip install requests python 3.7 Commands: git clone https://github.com/pwn0sec/PwnXSS chmod 755 -R PwnXSS cd PwnXSS python3 pwnxss.py --help Usage Basic usage: python3 pwnxss.py -u...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

The vulnerability of the FOQUZ platform, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the FOQUZ platform, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

Tiredful-API

What is Tiredful API? Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security...

XSSCon

A powerful XSS scanner made in python 3.7 Installing Requirements: BeautifulSoup4 pip install bs4 requests pip install requests python 3.7 Commands: git clone https://github.com/menkrep1337/XSSCon chmod 755 -R XSSCon cd XSSCon python3 xsscon.py --help Usage Basic usage: python3 xsscon.py -u...

CVE-2023-51281

CVE-2023-51281 Customer Support System 1.0 - “firstname”、“lastname”、“middlename”、“contact”、“address” パラメータにおける複数のクロスサイトスクリプティング（XSS）脆弱性 説明 : Customer Support System 1.0 の /customersupport/ajax.php?action=savecustomer における複数のクロスサイトスクリプティング（XSS）脆弱性により、認証済み攻撃者が...

cve-2020-35717

CVE-2020–35717 zonote는 조작된 노트를 통한 XSS를 허용하며, 그 결과 원격 코드 실행Remote Code Execution이 발생합니다Node.js 통합이 활성화되어 있기 때문. 취약점 악용 단계 영향을 받는 버전의 zonote를 다운로드합니다. zonote 앱을 엽니다. 메뉴 열기를 통해 xss-rce.znt를 zonote로 가져옵니다. 가져온 노트의 각 링크 위에 마우스를 올립니다. 공개 타임라인 2020-12-26 취약점 발견 및 소유자에게 연락 2020-12-26 소유자는 저장소를 유지보수하지 않고...

CVE-2022-31299

CVE-2022-31299 Haraj Script 3.7 - 반사형 XSS 익스플로잇 제목: Haraj Script 3.7 - 반사형 XSS 날짜: 2022-06-13 CVE: CVE-2022-31299 익스플로잇 작성자: Abdulaziz Saad @b4zb0z 공급업체 홈페이지: https://angtech.org/ 소프트웨어 링크: https://angtech.org/product/view/3 버전: 3.7 테스트 환경: LAMP, Ubuntu 악용 :...

CVE-2022-36432

CVE-2022-36432 Magento 2용 Amasty Blog Pro의 미리보기 기능에서 발생하는 교차 사이트 스크립팅XSS 설명 Magento 2용 Amasty Blog Pro 2.10.3 플러그인의 미리보기 기능은 eval을 안전하지 않게 사용합니다. 이로 인해 공격자는 생성된 미리보기 애플리케이션 응답을 조작하여 관리자 패널 사용자에 대한 교차 사이트 스크립팅 공격을 수행할 수 있습니다. 취약점은 blog/view/base/web/js/adminhtml/preview.js 파일에 존재합니다. 참조 자료에서 Magen...

CVE-2022-38374

CVE-2022-38374 다음에서 텍스트 복사: https://vulners.com/cve/CVE-2022-38374...

CVE-2024-46278-teedy_1.11_account-takeover

【CVE-2024-46278】teedy1.11account-takeover 【Teedy 1.11】XSS를 통한 계정 탈취 세부사항 파일 다운로드 시 XSS를 유발하는 취약점이 존재합니다. 이 XSS 취약점으로 인해 Teedy 관리자가 몇 번의 클릭만으로 계정을 탈취할 수 있습니다. 이 취약점은 CVE-2024-46278로 지정되었습니다: https://vulners.com/cve/CVE-2024-46278 PoC 공격자 계정으로 로그인합니다. 이 파일을 html 형식으로 업로드합니다. 필요에 따라 fetch의 “Origin”,...