AutoGenerateXalanPayload

AutoGenerateXalanPayload Introduction This is an automated payload generation tool for the JDK Xalan overflow vulnerability CVE-2022-34169. It was created because different JDK versions require different overflow payloads. Running this tool with different JDK versions will generate different XSLT...

Magento-ver.-2.4.6

Exploit Title: FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection Date: 2023-11-17 Exploit Author: tmrswrr Vendor Homepage: FireBear Studio Software Link: FireBear Studio Improved Import & Export Version: FireBear Improved Import & Export ver. 3.8.6...

CVE-2022-34169

CVE-2022-34169 PoC A malleable PoC and solution for the SUpwn challenge from SUCTF 2025. Based on this issue from the original discoverer Felix Wilhelm and this blog post thanat0s. Tries not to rely as much on hard constants as the existing PoCs out there. If you want to deliver a different java...

CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: forced Xalan TransformerFactory drops the JAXP external access restrictions Runnable proof-of-concept reproducer for the Apache Camel Quarkus vulnerability where the XSLT support extension camel-quarkus-support-xalan supplies its own Xalan-backed TransformerFactory...

CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via XSLT injection in Lutece Core Explanations and more on my website /xsl:styleshee...

CVE-2026-124448

OpenEMR versions before 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the CCDA/CCD preview stylesheets . The root cause is that cda.xsl copies event-handler attributes that evade a character denylist, while ccd.xsl copies unsanitized table-cell attributes into t...

CVE-2026-124448 OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can uplo...

CVE-2026-124448 OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can uplo...

CVE-2026-124448 OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can uplo...

mirth-connect-security-poc

NextGen Connect 4.5.2 vulnerability PoCs Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect Mirth Connect 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a...

CVE-2019-25137-Version-Research

CVE-2019-25137 Affected Version Research CVE-2019-25137 Overview CVE-2019-25137 is a XSLT injection vulnerability in Umbraco CMS. The vulnerability is present in the XSLT Extensive Stylesheet Language Transformations Visualizer webpage. The vulnerable URI for this webpage is...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – XSLT Server‑Side Injection via xsl:script Program Code Python + XSLT xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml = request.form'xml' xslt =...

NetSec-CVE-2023-4357

Network Security Project — CVE-2023-4357 Overview This project is a final project for a Network Security course. The project focuses on CVE-2023-4357, a vulnerability affecting Google Chrome versions prior to 116.0.5845.96. The vulnerability is related to the handling of XML/XSLT and can allow a...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

firefox: thunderbird: Use-after-free in the XSLT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component...

Exploit for CVE-2026-120218

CVE-2026-120218 — TypeMill stored XSS via SVG XSLT processing...

CLEANSTART-2024-ZR42121 iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame

CVE-2021-38503 affects multiple packages. The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. See references for individual vulnerability details...

CLEANSTART-2024-VB22624 It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox

CVE-2021-4140 affects multiple packages. It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. See references for individual vulnerability details...

CLEANSTART-2024-MI49895 cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)

Security vulnerability affects the firefox-esr package. A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions such as microphone or camera access...

CLEANSTART-2024-ZI86941 attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar

Security vulnerability affects the firefox-esr package. An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar...