CVE-2026-47761

👋 ¡Hola! Investigación de Seguridad 🛡️ CVE-2026-47761 – Investigador de Seguridad Tipo : Cross-Site Scripting Almacenado XSS Producto : TinyMCE Referencias : CVE : https://nvd.nist.gov/vuln/detail/CVE-2026-47761 GHSA : https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w Saló...

CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147：OpenSourcePOS 中的存储型跨站脚本（XSS）漏洞 元数据| 详细信息 ---|--- CVE ID| CVE-2025-68147 严重性| 高危 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N 漏洞类型| 存储型跨站脚本（CWE-79） 受影响版本| OpenSourcePOS v3.4.0, v3.4.1 修复版本| v3.4.2 受影响组件| 店铺配置模块（退货政策字段） 报告者| Aditya Singh Nixon-H 📝 摘要 在 OpenSourcePOS 的店铺配置...

CVE-2021-46069

CVE-2021-46069 Exploit Title: 车辆服务管理系统 - 'Mechanic List' 存储型跨站脚本 XSS Exploit Author: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46069...

CVE-2021-46078

CVE-2021-46078 Título del Exploit: Vehicle Service Management System - 'Múltiple' carga de archivos conduce a Cross-Site Scripting Almacenado Autor del Exploit: SANU P.L CVE: CVE-2021-46078 CVSS: 4.8 MEDIO Referencias:...

Vehicle-Service-Management-System-Service-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46072 Exploit 标题：Vehicle Service Management System - 'Service List' 存储型跨站脚本（XSS） Exploit 作者：SANU P.L CVE：CVE-2021-46072 CVSS：4.8 中危 参考： https://www.plsanu.com/vehicle-service-management-system-service-list-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46072...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability discovered by Pham Duc Anh in WordPress Plugin iubenda versions = 3.13.4...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by daroo in WordPress Plugin iubenda versions = 3.13.4...

CVE-2021-46073

CVE-2021-46073 Título del Exploit: Vehicle Service Management System - 'User List' Cross Site Scripting Almacenado XSS Autor del Exploit: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIO Referencias: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

CVE-2021-46068

CVE-2021-46068 Título del Exploit: Vehicle Service Management System - Cross Site Scripting Almacenado XSS en 'MyAccount' Autor del Exploit: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIA Referencias: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

CVE-2021-46072

CVE-2021-46072 Título del Exploit: Vehicle Service Management System - 'Service List' Cross Site Scripting XSS Almacenado Autor del Exploit: SANU P.L CVE: CVE-2021-46072 CVSS: 4.8 MEDIO Referencias:...

CVE-2026-37196

CVE-2026-37196 – Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 Descripción general Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 , donde la entrada proporcionada por el usuario en el campo de descripción del ticket no se sanitiza adecuadamente...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI 在启用“以富文本方式插入提示”时，存在通过提示触发的存储型 DOM XSS 漏洞，可导致账户接管（ATO）或远程代码执行（RCE） 摘要 当“以富文本方式插入提示”功能启用时，将自定义提示插入聊天窗口的功能容易受到 DOM XSS 攻击，因为提示内容被直接赋值给 DOM sink .innerHtml 而未经过净化。任何拥有创建提示权限的用户都可以利用此漏洞植入载荷，其他用户如果执行对应的 / 命令来插入该提示，就会触发该载荷。 详情 受影响的代码行位于：...

CVE-2026-86278

A cross-site scripting (XSS) vulnerability exists in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 , affecting an unknown function in manage_subjects.php . Manipulation of the msg/title/content arguments results in XSS, exploitable remotely with user interaction req...

CVE-2026-74252

XSS Almacenado en el Checkout de Invitados de J2Commerce mediante Bypass de Filtro de Cookies J2Commerce comj2store ≤ 4.1.5 — Un atacante no autenticado almacena un payload XSS que se ejecuta automáticamente en el navegador del administrador al cargar la página RESUMEN J2Commerce 4.1.5 es...

WordPress Powerkit plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Powerkit versions = 3.0.4...

CVE-2021-46080

CVE-2021-46080 Título del exploit: Vehicle Service Management System - 'Múltiple' Cross-Site Request Forgery CSRF conduce a Cross Site Scripting Almacenado XSS Autor del exploit: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM Referencias:...

CVE-2025-61638

CVE-2025-61638 node . "https://www.mediawiki.org/w/api.php"（已修复） 可以从 https://www.mediawiki.org/wiki/SitesusingMediaWiki 找到更多可攻击对象。 https://phabricator.wikimedia.org/T401099 https://vulners.com/cve/CVE-2025-61638 XSS 攻击需要编辑条目，因此需要至少 xss !== false 和 reg: true。anno: true 即匿名（ip）用户，可提升攻击能力。 由于部分 wiki...

CVE-2021-45745

CVE-2021-45745 Título del Exploit: Bludit 3.13.1 - Complemento About - Cross Site Scripting XSS Almacenado Autor del Exploit: SANU P.L CVE: CVE-2021-45745 CVSS: 5.4 MEDIO Referencias: https://www.plsanu.com/bludit-3-13-1-about-plugin-stored-cross-site-scripting-xss...

CVE-2024-34070

CVE-2024-34070 Froxlor PoC CVE-2024-34070 的概念验证 Python 程序，针对 Froxlor 2.1.9 之前版本中通过写入系统日志的失败登录尝试导致的存储型 XSS 漏洞。 警告 本项目仅用于授权的安全测试、CTF 实验室和教育目的。请勿对你不拥有或未获得明确许可的系统运行此程序。漏洞利用模式可以在目标 Froxlor 实例上创建一个管理员账户。 功能 检测 Froxlor 实例。 当提供有效凭据时，从经过身份验证的管理员会话中提取 Froxlor 版本。 报告检测到的版本是否存在漏洞（ 2.1.9）。 注入存储型 XSS 载荷，创建新的管理...

CVE-2025-63498

XSS almacenado en cookie Alinto/SOGo Investigadores: Daniil Khomichenok, Alexander Klimenko Versiones afectadas var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Código del set-cookie para recordar el inicio de sesión, que acepta inyecciones XSS...