CVE-2026-10522

CVE-2026-10522 affects the MemberHero WordPress plugin through version 6.9. The vulnerability exists in the plugin's frontend registration process , which does not restrict which account fields can be supplied. This allows unauthenticated attackers to register a new user with an arbitrary role—in...

CVE-2023-30256

Webkul Qloapps 1.5.2 - Cross-Site Scripting XSS Webkul QloApps 1.5.2: vulnerabile a XSS su due parametri emailcreate e back Exploit - Prova di concetto POC XXS: parametro 'back' root@kitploit: Payload Parameter back – Plain text: xss onfocus=alert1 autofocus= xss Payload Parameter back – URL...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei-Erkennungsvorlage Nuclei-Vorlage zur nicht-intrusiven Erkennung von XSS2Shell , einer ohne Authentifizierung ausnutzbaren Differential-Parser-Schwachstelle im WordPress-Core, die das Einschleusen von DOM-Elementen in die Login-Seite ermöglicht und als Grundlage für eine...

CVE-2024-41662

CVE-2024-41662 Markdown XSS porta a RCE in VNote versione NOTA: L'applicazione convalida correttamente alcuni payload JavaScript eseguendo una codifica di output nell'app. Tuttavia, non riesce a convalidarli in alcuni casi...

Trespasser

CVE-2026-74970 · Firefox Fission site-isolation bypass via missing PipelineId namespace check This directory holds an honest reproduction scaffold for a Fission site-isolation authorization bypass in Firefox WebRender. Under Fission each content process owns a distinct PipelineId namespace, but t...

CVE-2024-4367-Analysis

CVE-2024-4367: Beliebige JavaScript-Ausführung in PDF.js Übersicht CVE-2024-4367 ist eine kritische Schwachstelle in der PDF.js-Bibliothek, die die Ausführung beliebigen JavaScripts im Browser eines Benutzers ermöglicht und zu Cross-Site-Scripting-Angriffen XSS führt. Dies betrifft Firefox...

CVE-2025-11926

CVE-2025-11926 Wordpress-Related-Posts-Lite-plugin-XSS-PoC Für PoC: https://github.com/prabhatverma47/Wordpress-Related-Posts-Lite-plugin-XSS-PoC...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

weaponised-XSS-payloads

Payload XSS armati Payload XSS progettati per trasformare alert1 in P1. Il Post del Blog Questa repo è stata rilasciata insieme a un post del blog intitolato "Come Elevare i Tuoi Bug XSS da Medium a Critical" https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4 Cos'è quest...

1CRM-CVE

1CRM-CVE Уязвимость программного обеспечения 1CRM Список уязвимостей CVE-2019-14221: Хранимая межсайтовая подделка сценариев Stored Cross Site Scripting...

CVE-2026-76794

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

CVE-2024-50803-Redaxo

CVE-2024-50803 Stored XSS in der Mediapool-Funktion von Redaxo In Redaxo-Versionen 5.18.0 wurde eine gespeicherte Cross-Site-Scripting XSS-Schwachstelle gefunden, die es Angreifern mit ausreichenden Berechtigungen ermöglicht, eine schädliche SVG-Datei über die Mediapool-Funktion hochzuladen...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

cve-2019-10070-apache-atlas-xss

Questo repository non contiene un README...

XSS2Shell-CVE-2026-64638

Questo repository non contiene un README...

CVE-2024-24135

CVE-2024-24135: Produktbestand mit Export nach Excel - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24135.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24135/blob/main/CVE-2024-24135.md...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – एम्बेडेड स्क्रिप्ट के माध्यम से PDF JavaScript इंजेक्शन प्रोग्राम कोड Python जो दुर्भावनापूर्ण PDF जनरेट करता है root@kitploit: generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f:...

EUVD-2026-67845

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2025-25296

CVE-2025-25296 Prova di concetto POC Descrizione Questo progetto dimostra una prova di concetto POC per la vulnerabilità CVE-2025-25296 che colpisce Label Studio, uno strumento open-source per l'etichettatura dei dati. La vulnerabilità risiede nell'endpoint /projects/upload-example, che non riesc...