FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

ChangeTower

ChangeTower ChangeTower is intended to help you watch changes in web pages and get notified of any changes written in Go. This tool is good to know the web pages are updated something or not to work on the new site before others Installation Instructions ChangeTower requires go1.16+ to install...

behave

Behave! A Still in Development monitoring browser extension for pages acting as bad boys. NB : This is the code repository of the project, if you're looking for the packed extensions: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

corsair_scan

Welcome to Corsairscan Corsairscan is a security tool to test Cross-Origin Resource Sharing CORS misconfigurations. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. If this is not...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC Host exploit.html on localhost, port 80. Open the docx to pop calc. To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will...

CVE-2021-42392-Detect

CVE-2021-42392-Detect About The script detects vulnerable H2 server for the give list of IPs, it can identify the H2 Console web pages and check for access restrictions. Usage Create a file containing list of IPs and name the file IP.txt, place the 'IP.txt' and 'h2-detect.py' in a directory and...

CVE-2022-29380

CVE-2022-29380 CVE-2022-29380 Date: 25/05/2022 Author: OpenXP Team Software: Academy LMS Version: Academy LMS = v4.3 Type: Cross-Site Scripting OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' References:...

CVE-2026-119365 WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widge...

CVE-2026-114536

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3...

CVE-2026-114526

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1...

CVE-2026-114528

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1...

CVE-2026-114529

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

EUVD-2026-113571

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13...

CVE-2026-114526

The Black Hole theme for Drupal is vulnerable to a Stored Cross-site Scripting (XSS) flaw (CWE-79) due to insufficient sanitization of menu link titles before they are inserted into HTML class attributes. This affects versions 0.0.0 to 1.26.0 and 2.0.0 to 2.0.1 . Exploitation requires the ability...

CVE-2026-114529 CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CVE-2026-114534

The Drupal Block Attributes module (versions 0.0.0 to 2.1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of custom attributes. An attacker can inject malicious scripts into block attributes, though the risk is mitigated by the requirement for the administe...

CVE-2026-114536 USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3...