972 matches found
burpsuite-copy-as-xmlhttprequest
Copy as XMLHttpRequest BurpSuite extension The extension adds a context menu to BurpSuite that allows you to copy multiple requests as Javascript's XmlHttpRequest, which simplifies PoC development when exploiting XSS. Installation download the latest JAR from releases or build manually add JAR to...
Razer Sila Gaming Router - Remote Code Execution
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...
CVE-2017-7038
CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html';...
cve-2016-1764
PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...
CVE-2020-28502
CVE-2020-28502 node-XMLHttpRequest RCE NVD Description This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code bein...
CVE-2017-5638
CVE-2017-5638 CVE: 2017-5638 in different formats Most of them will require you to enter the url and you might want to change the command Please issue pull requests if you can make it so you can enter a url and command! PHP - Example http://localhost/2017-5638.php?url=TARGET&cmd=command...
CLEANSTART-2024-XG25219 Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols
CVE-2021-43542 affects multiple packages. Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. See references for individual vulnerability details...
CVE-2026-84917
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...
burpsuite-copy-as-xmlhttprequest
Extensión Copy as XMLHttpRequest para BurpSuite La extensión añade un menú contextual a BurpSuite que permite copiar múltiples solicitudes como XmlHttpRequest de Javascript, lo que simplifica el desarrollo de PoC al explotar XSS. Instalación descarga el último JAR desde releases o constrúyelo...
toxssin
toxssin Scopo toxssin è uno strumento open-source di penetration testing che automatizza il processo di sfruttamento delle vulnerabilità Cross-Site Scripting XSS. Consiste in un server https che funge da interprete per il traffico generato dal payload JavaScript dannoso che alimenta questo...
Malicious code in blue-string-formatter-utils (npm)
Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET to the protocol-relative URL //xss.report/c/k3rne111 whose...
Astra Linux – Vulnerability in Firefox and Thunderbird
Cross-Site Tracing occurs when a server echoes a request back using the Trace method, allowing an XSS attack to access authorization headers and cookies that are inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitigate this attack, browsers imposed restrictions on fetch and...
Malicious code in avalon-plugin-xmlhttprequest (npm)
The package avalon-plugin-xmlhttprequest was found to contain malicious code. --- Credit: OpenSSF source...
DRUPAL-CONTRIB-2026-127
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...
PT-2026-84893
Name of the Vulnerable Software and Affected Versions Jsonapi Role Access versions 0.0.0 through 2.0.2 Description An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a...
Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...
PT-2026-68983
Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...
CVE-2026-70604: Permissive Cross-domain Policy with Untrusted Domains
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...
PT-2026-68209
Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 40.9.3 Electron versions prior to 41.4.0 Electron versions prior to 42.0.0 Description A custom scheme registered with supportFetchAPI: true but without corsEnabled: true does not...