toastnotify-bof

toastnotify-bof A Beacon Object File BOF for sending Windows toast notifications. Pairs with the blog post for full context and use cases. subcommands getaumid Enumerates AUMIDs Application User Model IDs registered on the system. Use this to find a suitable identity to borrow before sending a...

toastfix-demo

ToastFix Demo This project demonstrates how convincing Windows toast notifications can be abused in social engineering attacks, specifically using ClickFix-style lures. A live demo is available here more realistic attack: 👉 https://h4lpy.github.io/ A detailed breakdown of the technique can be fou...

CVE-2020-0014-Toast

CVE-2020-0014 Toast Reproduction This vulnerability allows a malicious app to intercept user operations on the screen by constructing a clickable Toast view, thereby achieving the purpose of collecting sensitive information such as user passwords. Affected versions: Android 8.0, 8.1, 9, 10 Only...

CVE-2020-0014_Toast

This repository does not have a README...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

EUVD-2026-90019

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275

JetBrains YouTrack versions prior to 2026.2.19197 are vulnerable to stored XSS within the workflow error notification toast. This flaw allows for unauthorized script execution in the context of the user's session. Remediation is available in version 2026.2.19197 and subsequent releases. No specif...

CVE-2026-100275: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

PT-2026-103322

🚨 CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible 🎖@cveNotify...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'toast' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

CVE-2026-32822

Technical details are not publicly available in the provided documents. No specific affected versions, vulnerable components, or fixes are disclosed here. Monitor for updates.

PYSEC-2026-782 Apache Superset vulnerable to Injection

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions an...

Apache Superset vulnerable to Injection

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions an...

CVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...

WS-2020-0102

@toast-ui/editor through 2.1.2 is vulnerable to Cross-Site Scripting XSS. There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser...

CVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...

CVE-2026-42235

CVE-2026-42235 affects the n8n open-source workflow automation platform. An unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name. If a victim user approves the OAuth consent and another user later revokes that access, a toast renders the injected script,...

CVE-2026-42235 n8n: XSS via MCP OAuth client

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...