Lucene search
+L

97569 matches found

Kitploit
Kitploit
added 2026/09/17 12:38 p.m.12 views

CVE-2025-65676

CVE-2025-65676 Vulnerabilidad de Cross Site Scripting XSS Almacenado en Classroomio LMS 0.1.13 que permite a atacantes autenticados ejecutar código arbitrario a través de imágenes de portada SVG manipuladas. Descubierto por: Rivek Raj Tamang RivuDon, Sikkim, India. Producto afectado: ClassroomIO...

5.4CVSS6.6AI score0.00236EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/17 12:37 p.m.8 views

CVE-2025-63420

CVE-2025-63420 CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions. CWE CWE-79 — Improper Neutralization of Input During Web Page Generation Cross-site Scripting CVSS v3....

4.1CVSS6AI score0.0027EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/17 12:01 p.m.7 views

CVE-2025-67263

CVE-2025-67263 - Stored cross-site scripting XSS in Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting XSS vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name...

6.1CVSS5.8AI score0.00196EPSS
SaveExploits2
OSV
OSV
added 2026/09/17 11:50 a.m.6 views

BIT-MONGODB-2026-18708 Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

6.4CVSS0.00276EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/17 11:49 a.m.9 views

CVE-2026-11518-XSS

Stored XSS in Inventory System using PHP and MySQL Vulnerability Details...

5.3CVSS5.7AI score0.00388EPSS
SaveExploits0
Patchstack
Patchstack
added 2026/09/17 11:24 a.m.8 views

WordPress Brizy – Page Builder plugin <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Tharadol Suksamran d3kc4rt1 in WordPress Plugin Brizy versions = 2.8.14...

6.4CVSS0.00156EPSS
SaveExploits0References1Affected Software1
Kitploit
Kitploit
added 2026/09/17 11:10 a.m.12 views

CVE-2025-63307

CVE-2025-63307 – Authenticated Stored Cross-site Scripting XSS in laravel-file-manager v3.3.1 🧭 Overview An authenticated Stored Cross-site Scripting XSS vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitra...

8.1CVSS5.9AI score0.00369EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/17 10:58 a.m.11 views

CVE-2024-46982-Reproduction

Getting Started 1. Install Node.js LTS 2. npm install 3. npm run build 4. npm run start Exploitation 1: Stored XSS via Cache Poisoning 1. Send the following HTTP request Attack Request using any HTTP client. root@kitploit: GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS...

7.5CVSS7.4AI score0.5918EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/17 10:46 a.m.9 views

CVE-2025-45805

CVE-2025-45805 Poc Of CVE-2025-45805 Affected Product: Doctor Appointment Management System Vendor: phpgurukul Version: 1.0 Vulnerability Type: Stored Cross-Site Scripting XSS Description: An authenticated doctor user can inject arbitrary JavaScript code into the doctor profile field name/employe...

7.6CVSS6.1AI score0.00388EPSS
SaveExploits2References1
Cvelist
Cvelist
added 2026/09/17 7:05 a.m.31 views

CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

8.8CVSS0.00336EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.9 views

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

6.8CVSS0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.10 views

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

6.8CVSS0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.8 views

CVE-2026-87786

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order...

8.8CVSS0.00276EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.9 views

CVE-2026-88792

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

8.8CVSS0.00276EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/17 6:16 a.m.7 views

CVE-2026-85130

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interac...

8.8CVSS0.00276EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/17 6:13 a.m.7 views

WordPress Optimole plugin 4.2.3-4.2.11 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Optimole versions 4.2.3-4.2.11...

0.00462EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.34 views

CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

0.00235EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/17 6:00 a.m.7 views

WordPress EWWW Image Optimizer plugin < 8.7.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin EWWW Image Optimizer versions 8.7.7...

0.00235EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/17 6:00 a.m.19 views

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

0.00235EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.8 views

EUVD-2026-81354

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

6.8CVSS0.00235EPSS
SaveExploits0References1
Rows per page
Query Builder