162 matches found
AwesomeXSS
AwesomeXSS 这个仓库收集了各种 Awesome XSS 资源。欢迎贡献，请通过 issue 提交。 精彩内容 挑战 阅读与演讲 工具 思维导图 DOM XSS Payload Polyglot 标签与事件处理器 上下文突破 HTML 上下文 属性上下文 JavaScript 上下文 Confirm 变体 漏洞利用 探测 绕过 编码 技巧与诀窍 精彩挑战 prompt.ml alf.nu/alert1 xss-game.appspot.com polyglot.innerht.ml sudo.co.il/xss root-me.org chefsecure.com...
weaponised-XSS-payloads
Weaponised XSS Payloads 旨在将 alert1 升级为 P1 的 XSS 载荷。 博客文章 这个仓库与一篇题为 "How to Upgrade Your XSS Bugs from Medium to Critical" 的博客文章一同发布 https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4 这是什么？ 在这个仓库中，你会找到一系列 JavaScript 文件，它们可以被加载到 XSS 载荷中，以便在受害者浏览器的上下文中于流行的 CMS...
Tiny-XSS-Payloads
Tiny-XSS-Payloads 一个可在不同上下文中使用的短XSS有效载荷集合。 演示地址：https://tinyxss.terjanq.me 当前有效载荷 ... -- " !-- If unsafe-inline is disabled in CS...
payloads
攻击载荷 收集所有攻击载荷！一个 Web 攻击载荷合集。欢迎提交 Pull Request！ 使用方法 运行 ./get.sh 下载外部载荷，并解压所有已压缩的载荷文件。 载荷致谢 fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists - https://github.com/danielmiessler/SecLists xsuperbug - https://github.com/xsuperbug/payloads NickSanzotta -...
HackTools
欢迎使用 HackTools！ 简介 — 预览 — 安装 — 构建 — 支持 !NOTE 嘿……喜欢 HackTools 吗？👀 来看看 Penflow —— 我们的新安全测试伴侣！ 在 map.penflow.sh 试试看吧 🚀 !NOTE 亲爱的用户们， 我们激动地宣布一次重大改版！由于近期浏览器扩展环境的变化和多种复杂情况，我们决定将 HackTools 作为一个 Web 应用程序继续发展。 为了让你持续参与，我们在以下链接上传了最新的浏览器扩展 alpha 版本：https://hacktools.sh 敬请期待即将推出的新功能和改进！ 感谢你的支持。 面向进攻性安全专业人员...
xss-payload-list
xss-payload-list 🎯 跨站脚本（XSS）漏洞 Payload 列表...
EUVD-2026-48273
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...
CVE-2023-31434
The parameters nutzertitel, nutzervn, and nutzernn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations...
CVE-2025-23213
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content XSS Payloads. This vulnerability is fixed in 1.5.28...
CVE-2025-67341
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users...
CVE-2025-11504
The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcreator/dupasrala.txt file. This makes it possible for unauthenticated attackers to view the plugin's API key and subsequently us...
CVE-2025-11504 Quickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure
The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcreator/dupasrala.txt file. This makes it possible for unauthenticated attackers to view the plugin's API key and subsequently us...
CVE-2025-11504
CVE-2025-11504 concerns the Quickcreator – AI Blog Writer plugin for WordPress. Affected versions 0.0.9–0.1.17 expose the plugin’s API key via the /wp-content/plugins/quickcreator/dupasrala.txt file, enabling unauthenticated access. The exposure permits attackers to obtain the API key and use it ...
PT-2025-43593
Name of the Vulnerable Software and Affected Versions Quickcreator – AI Blog Writer plugin for WordPress versions 0.0.9 through 0.1.17 Description The Quickcreator – AI Blog Writer plugin for WordPress is susceptible to exposure of sensitive information. An unauthenticated attacker can access the...
EUVD-2017-6733
Malware in sbrugna...
EUVD-2021-23962
Malware in sbrugna...