Mezzanine-CMS-6.1.0-XSS

Mezzanine-CMS-6.1.0-XSS CVE-2025-50481 Description A cross-site scripting XSS vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post. CVE: CVE-2025-50481 Affected version:...

CVE-2021-36747

CVE-2021-36747 Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. Discovered: May 11th, 2018 The Blackboard Security Team has been notified of this issue. They acknowledged the vulnerability on May 14, 2018. Description: The Blackboard tool commonly...

lblfixer_cve_2023_28447

LabelGrup Networks, official PrestaShop Partner Module for PrestaShop 1.7.X to fix CVE-2023-28447 vulnerability Smarty JavaScript XSS For further information, check the following links: CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-28447 GitHub:...

CVE-2020-12432

CVE-2020-12432 Collabora CODE Click here 4. The victim opens the link and gets redirected to another service with all his cookies and local storage data sent over to another network Vi...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: ▶ grep -HnrE...

CVE-2026-18541 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-18541

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to stored cross-site scripting (XSS) . This flaw allows an authenticated user to inject arbitrary JavaScript code into the Web UI, which can alter intended functionality and potentially result in credentials disclosure within a trusted se...

CVE-2021-40223

CVE-2021-40223 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Stored XSS Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input on Security...

CVE-2023-2516

CVE-2023-2516: Stored XSS Vulnerability in Teampass 3.0.6 - M Nadeem Qazi Hey everyone, I wanted to share with you a vulnerability that I discovered in Teampass, a password management software. I found a stored XSS vulnerability CVE-2023-2516 that allows attackers to inject malicious code into...

CVE-2021-43141

CVE-2021-43141 Information about CVE-2021-43141, a reflected XSS in the planapplication section...

iTop-CVEs-exploit

iTop-CVEs-exploit This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get admin privileges on the software. Set up 1. Download the vulnerable iTOP version from docker sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1.1 2...

the-book-of-secret-knowledge

"Knowledge is powerful, be careful how you use it! " A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more. 📔 What is it? This repository is a collection of various materials and tools that I use every day in my work. It contains a lot of useful...

CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2023-29839

CVE-2023-29839 Hotel Druid 3.0.4 Stored Cross Site Scripting Vulnerability CMS Link: https://www.hoteldruid.com/ Version Affected: 3.0.4 Severity & CVSS: 5.4 Medium | Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N A Stored Cross Site Scripting XSS vulnerability exists in multiple pages in...

CVE-2023-41425

Wonder CMS RCE | | Description : XSS to RCE, Wonder CMS 3.2.0 evil/evil.php EOF zip -r evil.zip evil/ JS payload that will install the new theme cat form+action=" EOF Starting a new web server to serve payloads sudo python3 -m http.server $LPORTWEB & | | After sending the RCE XSS to administrator...

CVE-2026-109673 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

CVE-2026-109673

Frappe ERPNext versions prior to 15.103.0 and 16.x before 16.12.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the improper neutralization of certain record names when rendered on specific dashboards, tools, and portals. Authenticated attackers can craft malicious...

CVE-2026-109671 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109671

Frappe ERPNext versions before 15.113.0 and 16.x before 16.24.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is a profile field that renders content without proper escaping into portal pages. A low-privilege attacker can inject a malicious script into this field, whi...

CVE-2026-109670

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the rendering of record names without proper escaping . An attacker with write access to item master data can inject a malicious script into a rec...