149970 matches found
Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...
Visual Composer <= 45.16.0 - Unauthenticated LFI
Visual Composer Website Builder for WordPress = 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication. id: CVE-2026-12227 info:...
EUVD-2026-92044
W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...
CVE-2026-105124
W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...
CVE-2026-105124
The W (vincent-peugnet/wcms) content management system, versions through 3.18.0 , is vulnerable to unauthenticated stored XSS . The root cause is the lack of input sanitization in the login user field and the visitor comment website field . Attackers can inject scripts via failed login attempts, ...
CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments
W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...
Added-Pentest-Ground-to-vulnerable-websites-for-training
https://vulners.com/cve/CVE-2017-0089 Microsoft Windows Vista SP2、Windows Server 2008 SP2 和 R2 SP1 以及 Windows 7 SP1 中的 Uniscribe 允许远程攻击者通过精心制作的网站执行任意代码，又称“Uniscribe 远程代码执行漏洞”。此漏洞不同于 CVE-2017-0072、CVE-2017-0083、CVE-2017-0084、CVE-2017-0086、CVE-2017-0087、CVE-2017-0088 和 CVE-2017-0090 中描述的漏洞。...
CVE-2026-12227
CVE-2026-12227: Visual Composer Website Builder Inclusión Local de Archivos LFI No Autenticada Resumen CVE-2026-12227 es una vulnerabilidad crítica CVSS 9.8 de Inclusión Local de Archivos LFI no autenticada en el plugin Visual Composer Website Builder para WordPress, que afecta a todas las...
CVE-2026-12227
CVE-2026-12227: Inclusión Local de Archivos LFI No Autenticada en Visual Composer Website Builder Resumen CVE-2026-12227 es una vulnerabilidad crítica CVSS 9.8 de Inclusión Local de Archivos LFI no autenticada en el plugin Visual Composer Website Builder para WordPress, que afecta a todas las...
aarif450.github.io
dkpsir.github.io D. Kiran Prasad 的官方教育网站，包含讲座视频、笔记和学术资源。...
CVE-2024-9796
CVE-2024-9797 针对CVE-2024-9796的易受攻击的网站...
gha-lab-b5c1313658
自动化研究产物 — 非上游项目。 本仓库是由自动化工具链构建的一次性实验环境，用于拉瓦尔大学（Université Laval）硕士论文中复现已发表的 GitHub Actions 工作流漏洞研究。它是 eclipse-theia/theia-website 在提交 d272e2418221240a7c9f8480dd0576a65ca49625（2026-01-19）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未...
TeamsNTLMLeak
描述 当用户导航到一个“网站”选项卡，该选项卡指向一个特制网页时，可能会导致通过激活 Office URL 方案泄露 NTLM 哈希，从而将该过程简化为单次点击即可泄露。 如果用户尝试从浏览器打开格式为 ms-word:ofv|u|file://Share/File.docx 的链接，需要以下步骤： 1- 用户必须确认其打开 Word 的意图。 2- 用户必须确认并接受 MS Office 警告消息中所示的风险。 然而，在“网站”选项卡上，用户的操作被简化为仅需接受风险。 复现步骤 1. 在“攻击者”机器上运行 Responder 2. 托管一个包含以下代码的 HTML 页面： Auto...
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
EUVD-2026-91174
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...
osintnet-public
OsintNET 是一个基于浏览器的 OSINT 平台，用于域名情报、网站风险扫描、SERP 发现、电子邮件与用户名 OSINT、图像情报、图像真实性检查以及 AI 图像检测。 网站 · OSINT 工具 · 最佳 OSINT 工具 · AI OSINT 工具 · llms.txt · AI 提示映射 OsintNET - OSINT 平台、域名情报、网站风险扫描器与 AI 图像检测器 OsintNET 是一个基于网页的开源情报平台，用于授权的公开信号分析。它结合了域名情报、被动网站风险扫描、SERP 发现、深度 OSINT...
pathprober
pathprober Probe and discover HTTP pathname using brute-force methodology and filtered by specific word or 2 words at once. Purpose Brute-forcing website directories or HTTP pathname and validate using HTTP response code is not relevant anymore. This tool will help you to perform a penetration...