23112 matches found
CVE-2026-114526
The Black Hole theme for Drupal is vulnerable to a Stored Cross-site Scripting (XSS) flaw (CWE-79) due to insufficient sanitization of menu link titles before they are inserted into HTML class attributes. This affects versions 0.0.0 to 1.26.0 and 2.0.0 to 2.0.1 . Exploitation requires the ability...
CVE-2026-114534
The Drupal Block Attributes module (versions 0.0.0 to 2.1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of custom attributes. An attacker can inject malicious scripts into block attributes, though the risk is mitigated by the requirement for the administe...
Agentejo Cockpit 0.10.2 - Cross-Site Scripting
Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...
FortiWeb - Cross Site Scripting
FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...
Moodle LTI module Reflected - Cross-Site Scripting
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...
behave
Behave! A Still in Development monitoring browser extension for pages acting as bad boys. NB : This is the code repository of the project, if you're looking for the packed extensions: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...
ChangeTower
ChangeTower ChangeTower is intended to help you watch changes in web pages and get notified of any changes written in Go. This tool is good to know the web pages are updated something or not to work on the new site before others Installation Instructions ChangeTower requires go1.16+ to install...
corsair_scan
Welcome to Corsairscan Corsairscan is a security tool to test Cross-Origin Resource Sharing CORS misconfigurations. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. If this is not...
dnstwist
See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...
CVE-2026-116848
The The Plus Addons for Elementor Page Builder Lite plugin by POSIMYTH Innovations is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in versions 6.5.3 and below . The flaw stems from the improper neutralization of input during web page generation . This allows an attacker to inje...
CVE-2022-30190
CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC Host exploit.html on localhost, port 80. Open the docx to pop calc. To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will...
CVE-2026-115610
The PublishPress PublishPress Authors WordPress plugin (versions up to and including 4.17.0 ) is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. The root cause is the Improper Neutralization of Input During Web Page Generation . This flaw allows an attacker to store malicious sc...
CVE-2026-48195
The PDF Poster WordPress plugin (versions up to and including 2.6.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation , which allows an attacker to inject malicious scripts. Exploitation details are not p...
CVE-2021-42392-Detect
CVE-2021-42392-Detect About The script detects vulnerable H2 server for the give list of IPs, it can identify the H2 Console web pages and check for access restrictions. Usage Create a file containing list of IPs and name the file IP.txt, place the 'IP.txt' and 'h2-detect.py' in a directory and...
CVE-2022-29380
CVE-2022-29380 CVE-2022-29380 Date: 25/05/2022 Author: OpenXP Team Software: Academy LMS Version: Academy LMS = v4.3 Type: Cross-Site Scripting OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' References:...
CVE-2026-115612 WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13...
CVE-2026-115612 WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13...
CVE-2026-115606
The Crowd Favorite DXP ToolKit (dxp-toolkit) WordPress plugin, specifically versions up to and including 2.0.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious sc...
netgraph
Netgraph Netgraph is a packet sniffer tool that captures all HTTP requests/responses, and display them in web page. You can run Netgraph in your linux server without desktop environment installed, and monitor http requests/responses in your laptop's browser. Compile, Install, Run 1. go get...
