125622 matches found
CVE-2026-30503-OpenKM-6.3.12-Stored-XSS
π‘οΈ CVE-2026-30503 β Stored XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar β Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure π Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...
CVE-2026-36669-FengOffice
Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...
CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS
CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...
CVE-2023-29839
CVE-2023-29839 Hotel Druid 3.0.4 Stored Cross Site Scripting Vulnerability CMS Link: https://www.hoteldruid.com/ Version Affected: 3.0.4 Severity & CVSS: 5.4 Medium | Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N A Stored Cross Site Scripting XSS vulnerability exists in multiple pages in...
CVE-2021-38619
CVE-2021-38619 openBaraza HCM HR Payroll v.3.1.6 Unauthenticated Stored XSS Vulnerability openBaraza HCM v.3.1.6 does not properly neutralize user-controllable input, this could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative...
CVE-2024-34452
CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...
CVE-2022-42097
Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Comment . Attack Vectors: The attacker must post something on the "comment" and insert the XSS payload at the "comment" input, and...
sccm_sql_backdoor
sccmsqlbackdoor A proofβofβconcept tool that implants a controlled backdoor into a Management Point stored procedure, enabling indirect SQL execution through a legitimate MP HTTP service. Installation You can install by cloning the repository and installing the dependencies. $ git clone...
CVE-2024-5420-XSS
Description A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be...
CVE-2026-2472-Vertex-AI-SDK-Google-Cloud
Unauthenticated Stored Cross-Site Scripting XSS in genai/evalsvisualization.py of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 - github.com/googleapis/python-aiplatform Author: Joshua Provoste N-day Researcher & Dev Credits: Din AsotiΔ...
CVE-2023-34845
CVE-2023-34845 Vulnerability POC for CVE-2023-34845 Vulnerability I found a cross-site scripting attack on the new content creating page http://localhost:800/admin/new-content it will execute the script in user context allowing the attacker to access any cookies or sessions tokens retained by the...
CVE-2026-41472-POC
CyberPanel XSS to RCE CVE-2026-41472 One-click Remote Code Execution in CyberPanel v2.4.3 via unauthenticated API endpoints. Overview This exploit chains multiple vulnerabilities in CyberPanel's AI Scanner feature: 1. Unauthenticated Database Injection /api/ai-scanner/callback accepts arbitrary...
thingsboard
All-in-one IoT platform for data collection, processing, visualization, and device management. π‘ Get started β’ π Website β’ π Documentation β’ π Blog β’ π LinkedIn π Installation options Install ThingsBoard on-premises or use ThingsBoard Cloud. π‘ Getting started with ThingsBoard Check out our Gettin...
Appsmith-1.98-Stored-XSS-Exploit
CVE-2026-7299 - Appsmith 1.98 Stored XSS SQL Autocomplete innerHTML Sink Automated exploit for a stored cross-site scripting vulnerability in Appsmith's SQL query editor. A workspace Developer can inject arbitrary JavaScript via database table names that execute in any other workspace member's...
CVE-2024-46982
Next.js Cache Poisoning Exploit This tool automates the detection and exploitation of CVE-2024-46982 , a cache poisoning vulnerability in Next.js , where Server-Side Rendering SSR responses can be incorrectly cached as Static Site Generation SSG. This misconfiguration can lead to Stored XSS, DoS,...
CVE-2025-41088
CVE-2025-41088: Stored XSS in Xibo CMS I have discovered a Stored Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This vulnerability allows an authenticated attacker to inject malicious scripts into the application due to improper validation of user-supplied input. The issue resides in...
CVE-2021-42558
CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...
ibm-qradar-ajp_smuggling_CVE-2022-26377_poc
CVE-2022-26377 A Proof of Concept developed by @watchTowr to exploit an AJP Smuggling vulnerability to poison the HTTP Response Queue of an IBM QRadar instance with a stored redirect. Follow the watchTowr Labs Team for our Security Research https://labs.watchtowr.com/...
CVE-2026-79294
CVE-2026-79294 CVE-2026-79294 β Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...
CVE-2021-24807
CVE-2021-24807 Support Board 3.3.4 Authenticated Stored XSS Authenticated Stored Cross Site Scripting XSS Vulnerability exists in Support Board Version 3.3.4 via Notes parameter. The impact of cross-site scripting vulnerabilities can vary from one web application to another. It ranges from sessio...