CVE-2024-34070

CVE-2024-34070 Froxlor PoC Prueba de concepto en Python para CVE-2024-34070, un problema de XSS almacenado en Froxlor anterior a 2.1.9 a través de intentos de inicio de sesión fallidos escritos en el registro del sistema. ADVERTENCIA Este proyecto es solo para pruebas de seguridad autorizadas,...

CVE-2025-63498

Stored XSS in cookie Alinto/SOGo 연구자: Daniil Khomichenok, Alexander Klimenko 영향을 받는 버전 var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' XSS 인젝션을 매개변수 값으로 허용하는 로그인 기억 설정 쿠키 코드: root@kitploit: if rememberLogin response addCookie: self...

CVE-2026-10104-POC

CVE-2026-10104: Stored Cross-Site Scripting in Product Video Gallery for WooCommerce Summary...

CVE-2021-45744

CVE-2021-45744 Exploit Title: Bludit 3.13.1 - TAGS Field Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-45744 CVSS: 5.4 MEDIUM References: https://www.plsanu.com/bludit-3-13-1-tags-field-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-45744...

PT-2026-86770

Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MIS...

PT-2026-86756

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

Linux Distros Unpatched Vulnerability : CVE-2026-18708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed withi...

WordPress Zephyr Project Manager plugin <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Zephyr Project Manager versions = 3.3.205...

PT-2026-86682

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content process images' function using a flawed regex-based HTML attribute parser. This makes it possible for...

VulnCheck KEV: CVE-2025-6068

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-caption-title & data-caption-description HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825, Revanth Matte in WordPress Plugin LearnPress versions = 4.3.9.1...

CVE-2021-46070

CVE-2021-46070 Título del exploit: Vehicle Service Management System - Cross Site Scripting XSS Almacenado en 'Service Requests' Autor del exploit: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM Referencias:...

CVE-2025-67876

CVE-2025-67876: ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking Overview...

CVE-2020-13654

CVE-2020-13654 - XWiki Platform Descubierto y reportado por: Astaruf Artículo completo: https://nstsec.com/en/posts/xwiki-xss-cve-2020-13654/ Entrada NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-13654 Vulnerabilidad XWiki Platform anterior a la versión 12.8 no aplica codificación HTML a los...

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS Este repositorio revela una vulnerabilidad de seguridad descubierta en Motivian Content Management System v.41.0.0. CVE-2025-29094: Múltiples Cross-Site Scripting XSS Almacenados Esta vulnerabilidad fue reportada al proveedor de acuerdo con...

CVE-2025-66849

CVE-2025-66849 PoC de Escalada de Privilegios en Ghost CMS Resumen En Ghost Foundation Ghost CMS hasta la versión 6.4.0, el bloque HTML dentro del editor de borradores de publicaciones no sanitiza ni codifica correctamente el contenido proporcionado por el usuario, lo que resulta en una...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - Line 369 root@kitploit: .$thread-getTitle.''; 3. There are more! Root Cause: Forum thread titles are stored without proper sanitization Thread titles are displayed without HTML escaping in multiple...

CVE-2022-43097

CVE-2022-43097 All details about CVE-2022-43097 Software: Phpgurukul User Registration & User Management System v3.0 Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Description: Phpgurukul User Registration & User Management System v3.0 w...

CVE-2025-68723

CVE-2025-68723: Axigen WebAdmin Stored XSS Vulnerability Summary Multiple input fields within the Axigen WebAdmin interface lack proper sanitization, allowing for the execution of malicious JavaScript. These vulnerabilities enable a low-privileged administrator or an attacker leveraging Broken...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...