CVE-2021-24807

CVE-2021-24807 Support Board 3.3.4 认证存储型XSS Support Board 3.3.4 版本中存在通过 Notes 参数导致的认证存储型跨站脚本（XSS）漏洞。 跨站脚本漏洞的影响因 Web 应用不同而异，范围从会话劫持到凭证窃取及其他安全漏洞。通过利用跨站脚本漏洞，攻击者可以冒充合法用户并接管其账户。如果受害用户拥有管理员权限，根据账户及 Web 应用的权限，可能导致严重损害，例如修改代码或数据库以进一步削弱 Web 应用的安全性。 要利用此漏洞，您需要拥有代理或管理员级别的访问权限。 添加笔记功能 要利用此参数，我们需要进入聊天，点击笔记右侧的...

CVE-2023-33408

CVE-2023-33408 Minical 1.0.0 ist anfällig für gespeichertes Cross-Site-Scripting XSS Anbieter: https://github.com/minical/minical Demo-Anwendung: https://demo.minical.io/ PoC Schritt 1: Melden Sie sich bei der Minical-Anwendung an und navigieren Sie zu Raum-Raumstatus. Schritt 2: Klicken Sie auf...

CVE-2025-29471

Nagios Log Server में स्टोर्ड XSS भेद्यता व्यवस्थापक के लिए विशेषाधिकार वृद्धि ▶️ PoC प्रदर्शन तिथि: 2025-04-02 शोषण लेखक: सेठ क्राफ्ट विक्रेता होमपेज: https://www.nagios.com/ विक्रेता परिवर्तन सूची: https://www.nagios.com/changelog/log-server सॉफ्टवेयर लिंक:...

CVE-2024-27665

CVE-2024-27665 O Unifiedtransform v2.X é vulnerável a Cross-Site Scripting XSS Armazenado através do recurso de upload de arquivos no módulo Syllabus. Fornecedor: https://github.com/changeweb/Unifiedtransform PoC Passo 1: Faça login no aplicativo e navegue até o módulo Acadêmico. Passo 2: Crie...

CVE-2023-4220-PoC

CVE-2023-4220 رفع ملفات تعسفي / RCE - PoC أنشأت هذا السكربت لأتمتة استغلال CVE-2023-4220 والحصول على شل عكسي على جهاز Hack The Box PermX. هذه الثغرة تؤثر على إصدارات Chamilo LMS ≤ 1.11.24 ، بسبب عدم كفاية التحقق في وظيفة الرفع الكبير. يمكن لمهاجم غير مصادق رفع ملفات إلى دليل متاح للعامة، مما قد...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons = 3.7.9 — Authenticated Contributor+ Stored Cross-Site Scripting...

CVE-2026-33657

CVE-2026-33657 - Iniezione HTML Memorizzata in EspoCRM 9.3.3 nelle Notifiche Email Proof-of-concept autenticato per l'iniezione HTML memorizzata nelle notifiche email di EspoCRM 9.3.3. Riepilogo EspoCRM 9.3.3 genera le email di notifica dei post dello stream trasformando il corpo della nota con...

CVE-2025-46041

Anchor CMS v0.12.7 - संग्रहीत XSS CVE-2025-46041 Anchor CMS v0.12.7, /admin/pages/add इंटरफ़ेस के description फ़ील्ड में संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता के प्रति संवेदनशील है। CVE आईडी CVE-2025-46041 सारांश प्रकार: संग्रहीत XSS स्थान: पेज निर्माण इंटरफ़ेस /admin/pages/add प्रभाव:...

CVE-2026-30082

Vulnerabilidades de Cross-site Scripting XSS Armazenado no recurso de Edição da página de Lista de Pacotes de Software do IngEstate Server Versão afetada: IngEstate Server - 11.14.0 Função Afetada API afetada: API afetada: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC Para explorar esta...

CVE-2026-40487

CVE-2026-40487 - Postiz = 2.21.5 - Caricamento Arbitrario di File tramite Spoofing del MIME-Type per XSS Persistente fino al Furto dell'Account Scoperta e segnalata da: Astaruf Analisi completa: https://nstsec.com/en/posts/postiz-xss-cve-2026-40487/ Voce NVD:...

CVE-2026-41653

CVE-2026-41653: BentoPDF ≤ 2.8.2 - XSS persistente → Esfiltrazione di file Scoperta e segnalata da: Astaruf Analisi completa: https://nstsec.com/en/posts/bentopdf-xss-cve-2026-41653/ Avviso upstream: Avviso GHSA di alam00000/bentopdf Voce NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41653...

CVE-2025-61319

CVE-2025-61319: XSS persistente in ReNgine 2. Dopo il completamento della scansione, apri la scheda Vulnerabilità in ReNgine e visualizza i risultati. 3. Il payload viene eseguito nel contesto del browser dell'amministratore. Versioni interessate ReNgine = 2.2.0...

CVE-2025-29018

CVE-2025-29018 - Internet Banking System 2.0.0 Stored XSS in pagesaddacctype.php Beschreibung Eine Stored Cross-Site Scripting XSS -Sicherheitslücke besteht im Code Astro Internet Banking System 2.0.0 aufgrund unsanitisierter Eingabe im name-Parameter in pagesaddacctype.php. Angreifer können...

CVE-2025-29015

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pagesaccount.php Beschreibung Eine Stored Cross-Site Scripting XSS -Schwachstelle besteht in Code Astro Internet Banking System 2.0.0 über den Parameter name in /admin/pagesaccount.php. Bösartiger JavaScript-Code kann injiziert und im...

CVE-2026-30048

CVE-2026-30048 - Cross-Site Scripting XSS persistente in NotChatbot WebChat = 1.5.0 Riepilogo Esiste una vulnerabilità di Cross-Site Scripting XSS persistente nel pacchetto @developer.notchatbot/webchat nelle versioni fino alla 1.5.0 inclusa. L'input fornito dall'utente non viene adeguatamente...

CVE-2022-43271

CVE-2022-43271 Cross-Site Scripting XSS Armazenado Produto: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software Data de descoberta: 2/8/2022 Data de correção: 4/8/2022 Versão afetada: versão 4, build 260 Versão corrigida: versão 4, build 261 Descrição: A vulnerabilidade foi descoberta n...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 è una vulnerabilità di Cross-Site Scripting persistente Stored XSS che interessa Mautic 7 versioni dalla 7.0.0 alla 7.1.1. La falla risiede nel componente Projects, in cui i nomi dei progetti vengono visualizzati come tag e popover al passaggio del mouse sulle pagine...

CVE-2022-48429_poc

CVE-2022-48429 - YouTrack संग्रहित XSS NVD डेटाबेस पर CVE का रिपोर्ट किया गया विवरण सटीक नहीं है। यह अधिक सटीक विवरण है: Youtrack संस्करण = 2022.3.65373 में डैशबोर्ड में एक संग्रहित क्रॉस-साइट स्क्रिप्टिंग XSS है। एक दुर्भावनापूर्ण निम्न-विशेषाधिकार वाला उपयोगकर्ता एक दोषपूर्ण डैशबोर्ड बना सकता ह...

MpOperationLogs

CVE-2023-5538 wordpress plugin MpOperationLogs = 1.0.1 - Unauthifiziertes gespeichertes Cross-Site Scripting...

CVE-2026-12948

CVE-2026-12948 Resumo da Vulnerabilidade Foi identificada uma vulnerabilidade de cross-site scripting XSS armazenado na interface de gerenciamento web do Digi PortServer TS 4 H MEI. Uma solicitação autenticada especialmente elaborada permite que um payload de script seja gravado permanentemente n...