WindowSpy

WindowSpy 👀 WindowSpy is a Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth durin...

CVE-2021-38602

CVE-2021-38602 A stored cross site scripting vulnerability is present on the Article editing page in version 5.8.7 of PluXML. User input is not properly sanitized in multiple fields. Vulnerable Fields: Headline optional: Content: Once inserted, XSS can be triggered by visiting the posted article ...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter. id: CVE-2021-40973 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

WordPress Title Experiments Free <9.0.1 - SQL Injection

WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpextitles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive...

CVE-2025-65640

CVE-2025-65640 1. Vulnerability Information CVE ID: CVE-2025-65640 Currently RESERVED Vulnerability Type: Stored Cross-Site Scripting XSS CVSSv3 score: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Vendor: Arket/Bluenext S.r.l. Product: Globe Document Intelligence Affected Version: 5.0.0.559 Discoverer...

CVE-2019-19651

CVE-2019-19651 Chevereto XSS reflejado en el nombre del sitio web, doctitle y descripción - 1.0.0 - 1.1.4 Free, Configuración - Nombre del sitio web, Doctitle del sitio web, Descripción del sitio web Al introducir esto, se reflejará en todo el sitio para todos los usuarios root@kitploit: "ChevtCh...

CVE-2024-25292

RenderTune RCE A Proof-Of-Concept for CVE-2024-25292 vulnerability. A cross-site scripting XSS vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter. In this repository there is an example...

CVE-2022-43332

CVE-2022-43332 Cross Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Wondercms v3.3.4 allows potential attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel - coupled with the fac...

CVE-2023-44758_GDidees-CMS-Stored-XSS---Title

GDidees Stored XSS v3.0 Author: Sergio Description: Cross Site Scripting vulnerability in GDidees v.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Page Title. Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Page Title allows...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 allows SQL Injection Suggested description : "ISIDA RETRIEVER v5.2" SQL Injection Vulnerable functionality : ISIDA RETRIEVER Platform is vulnerable to SQL Injection Vulnerable URL and paramert : website.com/index.php?title=Injection Vulnerable URL and parame...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the My Preferences - Manage Shortcuts Attack Vectors: Scripting A vulnerability in the...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow is a platform for business transformation which helps companies manage digital workflows for enterprise operations. CVE-2024-4879 could allow an unauthenticated user to remotely execute code within the Now Platform. This vulnerability exploits three issues by...

CVE-2024-41503

CVE-2024-41503 CVE: CVE-2024-41503 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Vulnerability: Stored Cross-Site Scripting XSS Description: The "Busca" search function used throughout the application contains a filter option that can be saved - when saving it, there is...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Descripción: Vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 que permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Título del menú Contenido - Noticias. Vectores de ataque: Una...

CVE-2024-39248

Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Exploit Author: Jason Jacobs 0xjasonjacobs - Twitter Vendor Homepage: https://sourceforge.net/projects/simpcms/ Vulnerable endpoint: /SimpCMS/admin.php A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows...

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

CVE-2026-90567

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The...