958 matches found
burpsuite-copy-as-xmlhttprequest
Copy as XMLHttpRequest BurpSuite extension The extension adds a context menu to BurpSuite that allows you to copy multiple requests as Javascript's XmlHttpRequest, which simplifies PoC development when exploiting XSS. Installation download the latest JAR from releases or build manually add JAR to...
CVE-2017-5638
CVE-2017-5638 CVE: 2017-5638 in different formats Most of them will require you to enter the url and you might want to change the command Please issue pull requests if you can make it so you can enter a url and command! PHP - Example http://localhost/2017-5638.php?url=TARGET&cmd=command...
cve-2016-1764
PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...
CVE-2020-28502
CVE-2020-28502 node-XMLHttpRequest RCE NVD Description This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code bein...
Razer Sila Gaming Router - Remote Code Execution
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...
CVE-2017-7038
CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html';...
burpsuite-copy-as-xmlhttprequest
Extensión Copy as XMLHttpRequest para BurpSuite La extensión añade un menú contextual a BurpSuite que permite copiar múltiples solicitudes como XmlHttpRequest de Javascript, lo que simplifica el desarrollo de PoC al explotar XSS. Instalación descarga el último JAR desde releases o constrúyelo...
toxssin
toxssin Scopo toxssin è uno strumento open-source di penetration testing che automatizza il processo di sfruttamento delle vulnerabilità Cross-Site Scripting XSS. Consiste in un server https che funge da interprete per il traffico generato dal payload JavaScript dannoso che alimenta questo...
Astra Linux – Vulnerability in Firefox and Thunderbird
Cross-Site Tracing occurs when a server echoes a request back using the Trace method, allowing an XSS attack to access authorization headers and cookies that are inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitigate this attack, browsers imposed restrictions on fetch and...
DRUPAL-CONTRIB-2026-127
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...
Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...
PT-2026-84893
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...
PT-2026-68983
Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...
CVE-2026-70604: Permissive Cross-domain Policy with Untrusted Domains
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...
PT-2026-68209
Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 40.9.3 Electron versions prior to 41.4.0 Electron versions prior to 42.0.0 Description A custom scheme registered with supportFetchAPI: true but without corsEnabled: true does not...
CLSA-2026-1785204344 TuxCare security update for xmlhttprequest-ssl (2 CVEs)
TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1777336760 TuxCare security update for xmlhttprequest (1 CVE)
TuxCare rebuilt xmlhttprequest to address 1 CVE. Fixed in 1.4.2-tuxcare.1...
CLSA-2026-1773188115 TuxCare security update for xmlhttprequest-ssl (2 CVEs)
TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.3-tuxcare.1...