CVE-2025-64512

パラメータ、つまり Target と Uploaddir を必ず入力してください。...

CVE-2022-25257

CVE-2022-25257 SAS Logon 9.4 допускает инъекцию предупреждающего сообщения. Обнаружено: 15 февраля 2022 г. Затронутые версии: 9.4 POC-эксплойт: SASLogon/csrf имеет один параметр под названием "target" Этот параметр влияет на предупреждающее сообщение для URL, который пользователь собирался открыт...

CVE-2018-1263-Demo

Демонстрация эксплойта Это руководство поможет вам установить уязвимый компонент и выполнить атаку, связанную с ошибкой phpMyAdmin, упомянутой в CVE-2018-1263. Описание CVE Почему существует уязвимость Как работает атака Как установить уязвимый компонент Как выполнить атаку Описание CVE Эта...

CVE-2021-23017-PoC

CVE-2021-23017-PoC pip install -r requirements.txt python3 poc.py --target 172.1.16.100 --dnsserver 172.1.16.1 이 소프트웨어는 순수하게 학술 연구와 효과적인 방어 기법 개발을 목적으로 제작되었으며, 명시적으로 승인된 경우를 제외하고 시스템을 공격하는 데 사용하기 위한 것이 아닙니다. 프로젝트 유지 관리자는 소프트웨어의 오용에 대해 책임을 지지 않습니다. 책임감 있게 사용하십시오...

CVE-2026-6171

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's btbbicon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

CVE-2026-6171

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.7.2 . The root cause is insufficient input sanitization and output escaping on the 'target' parameter of the plugin's bt_bb_icon shortcode. This flaw allows authenti...

EUVD-2026-89668

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's btbbicon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

CVE-2021-23017-PoC

CVE-2021-23017-PoC python3 poc.py --target 172.1.16.100 --dnsserver 172.1.16.1...

CVE-2026-41897 MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field

Mantis Bug Tracker MantisBT is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filtertarget parameter on returndynamicfilters.php normally used as an AJAX in View Issues Page allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. This...

SQL Injection

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to SQL Injection in the elFinderVolumeMySQL process when handling the target parameter. An attacker can access unauthorized data or cause...

CVE-2026-1806

The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcmsdoclink shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possib...

EUVD-2026-13989

The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcmsdoclink shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-1806

The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcmsdoclink shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possib...

PT-2026-26816

The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms doc link shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-1806: Improper Neutralization of Input During Web Page Generation

The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcmsdoclink shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-28415

Gradio prior to 6.6.0 exposes an open redirect in the OAuth flow: _redirect_to_target() accepts an unvalidated _target_url, enabling redirection to arbitrary external URLs via /logout and /login/callback for apps using gr.LoginButton (e.g., Hugging Face Spaces). Starting with 6.6.0, the _target_u...

CVE-2019-25421

Comodo Dome Firewall 2.7.0 contains multiple cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the policyfw endpoint. Attackers can submit POST requests with JavaScript payloads in the mac, target, and remark parameters to execute arbitrary code in...

CVE-2019-25422

CVE-2019-25422 affects Comodo Dome Firewall 2.7.0 and describes cross-site scripting vulnerabilities in the vpnfw endpoint. The weakness allows attackers to inject scripts via the target parameter (reflected XSS) or the remark parameter (stored XSS), potentially leading to execution of arbitrary ...

CVE-2019-25421

Comodo Dome Firewall 2.7.0 contains multiple cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the policyfw endpoint. Attackers can submit POST requests with JavaScript payloads in the mac, target, and remark parameters to execute arbitrary code in...

PT-2026-20824

Comodo Dome Firewall 2.7.0 contains multiple cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the policyfw endpoint. Attackers can submit POST requests with JavaScript payloads in the mac, target, and remark parameters to execute arbitrary code in...