58959 matches found
toxssin
toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...
CVE-2021-43032
CVE-2021-43032 In XenForo ≤ 2.2.7, a threat actor with access to the admin panel can save cross-site scripting payloads in any function within the application that accepts HTML code. A payload placed within the 'Advertising' functionality will execute globally on the client side, allowing for...
CVE-2026-47096
AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...
vuln-chain-lab
File Upload Bypass + Stored XSS PoC Lab A deliberately vulnerable web application demonstrating how a file upload bypass chains with stored XSS to create backdoor admin accounts, even when CSP, CORS, and CSRF protections are in place. Full Blog Post: KurtiseBear Blog This is an educational lab fo...
CVE-2026-102126
A stored cross-site scripting (XSS) weakness exists in Kiteworks Core . An administrator with a single, narrowly scoped delegated permission can store crafted content that executes arbitrary JavaScript within the session of a System Administrator who views the page. This vulnerability could allow...
CVE-2026-102100
Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This weakness allows an authenticated user to submit malicious content that executes arbitrary JavaScript when viewed by another user within their authenticated session. Such exploitation could enab...
CVE-2026-102147
A stored cross-site scripting (XSS) weakness exists in Kiteworks Core that allows an unauthenticated attacker to inject and store crafted content. When an administrator views the affected page, the content executes arbitrary JavaScript within their authenticated session. This vulnerability could ...
CVE-2026-102092
Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-site Scripting (XSS) flaw. An authenticated attacker can store crafted content that executes arbitrary JavaScript in another user's authenticated session during the preview of shared content. This vulnerability could lead to ...
CVE-2026-97265
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...
CVE-2026-103445
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS. This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43...
EUVD-2026-90216
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...
CVE-2026-97265
The Crocoblock. Jetimpex Inc. JetEngine WordPress plugin (versions up to and including 3.8.15.3 ) is vulnerable to Stored Cross-site Scripting (XSS) . This flaw stems from the improper neutralization of input during web page generation. Successful exploitation could allow an attacker to inject ma...
CVE-2026-97265 WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...
thingsboard
All-in-one IoT platform for data collection, processing, visualization, and device management. 💡 Get started • 🌐 Website • 📚 Documentation • 📔 Blog • 🔗 LinkedIn 🚀 Installation options Install ThingsBoard on-premises or use ThingsBoard Cloud. 💡 Getting started with ThingsBoard Check out our Gettin...
CVE-2026-103444
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master...
CVE-2026-103445
The MediaWiki Page_Forms extension versions 1.46, 1.45, and 1.43 are vulnerable to a Stored XSS vulnerability. The root cause is the improper neutralization of Script-Related HTML tags in a web page. This flaw allows an attacker to execute malicious scripts in the context of the user's browser. N...
EUVD-2026-90196
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS. This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43...
CVE-2026-103445 Stored XSS through PageForms #autoedit redirect links
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS. This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43...
CVE-2026-103445 Stored XSS through PageForms #autoedit redirect links
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS. This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43...
CVE-2026-103444
The MediaWiki WikiForum extension (master branch) is vulnerable to Stored XSS due to improper neutralization of script-related HTML tags. This allows an attacker to store malicious scripts on a web page. While the CVSS score indicates a low severity (2.0) requiring high privileges and user intera...