17116 matches found
Cross-site Scripting (XSS)
Overview httpbin is a HTTP Request and Response Service Affected versions of this package are vulnerable to Cross-site Scripting XSS via the endpoint /base64 which does not encode user-controllable parameters when outputting them on the current page. An attacker can inject and execute arbitrary...
Kentico Xperience Email Marketing Template Cross-Site Scripting Vulnerability
Kentico Xperience is a digital experience platform from Kentico. A cross-site scripting vulnerability exists in the Kentico Xperience email marketing templates, which can be exploited by attackers to execute malicious scripts that can compromise a user's browser and steal sensitive information...
The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform, related to the lack of protective measures for website structures, allows attackers to carry out XSS attacks.
The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
PT-2025-52760
Hackers Exploit List-Unsubscribe Header for XSS and SSRF Attacks The List-Unsubscribe SMTP header can be exploited for XSS and SSRF attacks if not properly validated. Examples include Horde Webmail CVE-2025-68673 allowing JavaScript URIs and Nextcloud Mail risking SSRF. Proper validation,...
CVE-2025-67291
A stored cross-site scripting XSS vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field...
web-security-vulnerability-labs
web-security-vulnerability-labs This repository documents han...
CVE-2020-36891 Kentico Xperience <= 12.0.49 File Upload Stored XSS
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute i...
CVE-2025-60043
The CVE-2025-60043 entry concerns the WordPress Wanderic theme (
CVE-2025-58946 WordPress Vocal theme <= 1.12 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Vocal vocal allows PHP Local File Inclusion.This issue affects Vocal: from n/a through = 1.12...
PT-2025-52255
Name of the Vulnerable Software and Affected Versions Dify version 1.9.1 Description A Cross-Origin Resource Sharing CORS misconfiguration exists in the /console/api/system-features endpoint. The endpoint has an overly permissive CORS policy that reflects arbitrary Origin headers and sets...
Exploit for CVE-2015-1427
Penetration Testing Framework !License: MIThttps://img.sh...
CVE-2025-68163
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page...
CVE-2025-68062
CVE-2025-68062 — WordPress MinimogWP theme <= 3.9.6 suffers an improper filename handling vulnerability allowing PHP Local File Inclusion via Include/Require in the PHP program (PHP Remote File Inclusion). The issue is classified as a high-severity vulnerability (CVSS v3.1 base score 7.5) with...
📄 Craft CMS 5.0 Twig Template Injection Scanner
This is a mass scanning script for the Craft CMS version 5.0 Twig template injection vulnerability. ============================================================================================================================================= | Title : Craft CMS 5.0 Twig Template Injection – Mass...
📄 Hestia Control Panel 1.9.3 Code Execution
Hestia Control Panel version 1.9.3 code injection proof of concept exploit written in PHP that leverages cronjobs. ============================================================================================================================================= | Title : Hestia Control Panel 1.9.3 PHP...
xss-demo
This repo presents the various types of Cross Site Scripting XS...
CVE-2025-67906
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the \authentication\ file. An attacker can inject and execute arbitrary scripts by submitting crafted input to the affected endpoint. Details Cross-site scripting or XSS is a code vulnerability that occurs...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-30926)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-30929)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...