111 matches found
CVE-2026-76569
Phoca Download 中通过搜索 GET 参数导致的反射型 XSS Phoca Download ≤ 6.1.4 — 已认证攻击者可通过用户控制面板中的构造搜索 URL 执行任意 JavaScript 摘要 用于 Joomla 的 Phoca Download（comphocadownload）在用户控制面板的文件搜索功能中存在反射型跨站脚本（XSS）漏洞。search GET 参数通过 Joomla 的 'string' 过滤器处理——该过滤器仅调用 striptags 并保留 " 字符——随后未经 htmlspecialchars 转义即被回显到 HTML...
CVE-2026-52774-YESWIKI-XSS
CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 是 YesWiki 的 Bazar 组件处理器中存在的一个反射型 XSS 漏洞。NoSuchPage/widget 端点中的查询参数仅使用 striptags 进行过滤，而该函数不会转义双引号，导致过滤不充分。攻击者可借此突破 HTML 属性边界，将 JavaScript 事件处理器（如 onmouseover）注入到 data-iframeUrl 属性中。 该漏洞已在 4.6.6 版本中通过为 WidgetHandler 方法中的 $urlParams 添加 urlencode 得到修复。 🔬 漏洞详情...
CVE-2022-44276-PoC
CVE-2022-44276-PoC Responsive Filemanager 。但我们可以耍个小技巧：函数 getextensionfrommime 是基于文件的前几个字符工作的。所以，如果我们用几个 'a' 字符开始我们的载荷，它会被检测为 txt 类型。 如何利用 1. 使用Burp Suite拦截上传请求 2. 将文件名改为 shell.php...
django-vulnerability-CVE-2025-32873
Django Security Issue on striptags requirements Django 5.2 Django Rate Limit pip install django-ratelimit...
CVE-2026-64638
PoC de Alerta XSS2Shell CVE-2026-64638 Prueba de concepto de XSS reflejado sin autenticación previa en WordPress Prueba de concepto en un único archivo HTML para el CVE-2026-64638 XSS2Shell, un XSS diferencial de analizador en el núcleo de WordPress. Demuestra la ejecución de JavaScript sin...
CVE-2026-64638
CVE-2026-64638 — XSS2Shell: XSS de preautenticación en la página de inicio de sesión de WordPress → RCE en el servidor Espejo de distribución de HackSpeak. Este repositorio es un espejo de distribución del PoC educativo XSS2Shell CVE-2026-64638 publicado por WordSec , con el código idéntico al...
WordPress WP-Stats 2.5.6 Cross Site Scripting
WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...
cve-2026-64638-banner-poc
CVE-2026-64638 — 通用横幅 PoC 一个单文件、无依赖的 PoC 生成器，针对 WordPress CVE-2026-64638 在 wp-login.php 上的反射型 HTML 注入（striptags 与 KSES 解析器 差异）。它生成一个自动提交的触发页面：当受害者打开该文件时，页面会静默 POST 注入载荷， 受害者将直接落在目标登录页面上并渲染出横幅——无需交互，目标端无需 JavaScript。 仅限授权的安全测试。 仅可针对您拥有或明确获授权测试的系统使用。 受影响版本（经验证） 版本| 状态 ---|--- 6.4.0 – 7.0.2|...
CVE-2026-52774
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...
CVE-2026-52774
YesWiki (a PHP wiki system) is vulnerable to reflected XSS (CWE-79) in its Bazar widget handler prior to version 4.6.6. The id GET parameter is reflected into the data-formid and data-iframeUrl HTML attributes using only strip_tags(), which does not escape double quotes. An unauthenticated attack...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The striptags method and the striptags template filter are vulnerable to a potential denial-of-service attack due to certain inputs containing large sequences of nested incomplete HTML entities...
GHSA-5CWR-5JXG-PCF6 Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...
Exploit for CVE-2026-64638
xss2shell-check Non-destructive, dependency-free detector for...
PT-2026-71456
Serendipity versions = 2.3.5 and . In include/functions routing.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives strip tags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search li...
GHSA-JMQM-F8Q4-V7WX LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...
GHSA-VGP4-2FC4-QFF2 Winter: Stored XSS through Editor Settings custom styles
Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...
GHSA-X3HR-CP7X-44R2 CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Summary The Google Maps iframe setting cMap field in compInfosPost sanitizes input using striptags with an allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an...
Unity Linux 20.1070e Security Update: python-django (UTSA-2026-006130)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006130 advisory. An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.striptags function is vulnerable to a potential...
CVE-2026-27016 LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks striptags sanitization while other fields name, oid, datatype are sanitized. The...
