EUVD-2026-71218

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2025-67906

-c0392b?style=flat -orange?style=flat CVE-2025-67906 MISP = 2.5.27 - वर्कफ़्लो इंजन के माध्यम से संग्रहित क्रॉस-साइट स्क्रिप्टिंग doT.js टेम्पलेट इंजेक्शन Franck FERMAN द्वारा खोजा गया अवलोकन - मूल कारण - हमला श्रृंखला - संरचना - उपयोग - सुधार - संदर्भ भेद्यता अवलोकन CVE-2025-67906...

CVE-2026-8447

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a stored cross-site scripting vulnerability in the Playground chat interface. The root cause is the MarkdownField component rendering chat messages via the rehypeRaw plugin without a sanitization pass, allowing attacker-controlled LLM respons...

EUVD-2026-71216

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

CVE-2024-48326

CVE-2024-48326 الوصف: Portabilis i-Educar v2.8.0 عرضة لثغرة البرمجة النصية عبر المواقع XSS عبر المعامل nmreligiao في طلب POST على /intranet/educarreligiaocad.php ويتم تشغيلها في طلب GET على /intranet/educarreligiaolst.php?busca=S&nmreligiao=. وهذا يسمح لمهاجم بعيد غير مصادق بحقن JavaScript خبيث،...

CVE-2026-9186

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain an improper access control vulnerability (CWE-284) in the MCP configuration installation endpoint. The endpoint enforces a localhost-only restriction using a client IP helper that blindly trusts the X-Forwarded-For header without verifying th...

CVE-2023-49977

CVE-2023-49977 Customer Support System 1.0 - ثغرة البرمجة النصية عبر المواقع XSS في حقل/معامل "Address" في صفحة "customerlist" الوصف : Customer Support System 1.0 عرضة لثغرة XSS مخزنة. توجد ثغرة XSS في الإصدار 1 من Customer Support System. يمكن للمهاجم إدراج كود JavaScript من خلال حقل/معامل...

CVE-2026-19057

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

dalfox

Looking for the Go v2.x version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy, and the migration guide for what changed in v3. Dalfox is a powerful open-source tool that...

EUVD-2026-71213

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-19057

Gastromenum Ticket and QR Menu System is affected by a Stored Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The flaw affects versions before 2026.08.31 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with an attack vector of ne...

EUVD-2026-71103

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19057 Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

bxss

Bxss - Blind XSS Scanner 🚀 Description...

vulnknox

VulnKnoX VulnKnox is a powerful command-line tool written in Go that interfaces with the KNOXSS API. It automates the process of testing URLs for Cross-Site Scripting XSS vulnerabilities using the advanced capabilities of the KNOXSS engine. Features Supports pipe input for passing file lists and...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

CVE-2025-12101-Scanner-PoC

CVE-2025-12101 स्कैनर CVE-2025-12101 के लिए मल्टी-थ्रेडेड भेद्यता स्कैनर - Citrix NetScaler में SAML RelayState के माध्यम से XSS भेद्यता। अवलोकन CVE-2025-12101 Citrix NetScaler ADC और Gateway उत्पादों में एक रिफ्लेक्टेड XSS भेद्यता है जो /cgi/logout एंडपॉइंट को RelayState पैरामीटर के माध्यम से...

CVE-2025-6563

نشرة استشارية: ثغرة XSS المنعكسة في صفحة تسجيل الدخول إلى نقطة اتصال MikroTik نظرة عامة تم اكتشاف ثغرة من نوع Cross-Site Scripting XSS المنعكسة في صفحة تسجيل الدخول إلى نقطة الاتصال Hotspot في MikroTik RouterOS. تُستغل الثغرة عبر معامل URL المسمى dst، الذي لا يعقّم المدخلات بشكل صحيح، مما يسمح...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...