CVE-2026-16654 Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 è una vulnerabilità XSS riflessa in Wonder CMS che consente inoltre di eseguire codice arbitrario tramite uno script dannoso attraverso il componente installModule. Utilizzo Eseguendo l'exploit contro l'loginURL del target, specificando il nostro IP e la porta per il...

CVE-2024-4367-PDF.js-xss

CVE-2024-4367–PDF.js-xss CVE-2024-4367–PDF.js-xss Umgebung herunterladen, entpacken und hineinwechseln root@kitploit: unzip cve-2024-4367-lab cd cve-2024-4367-lab Startbefehl für die Umgebung root@kitploit: mkdir upload chmod 777 upload docker-compose up -d...

CVE-2025-65270

CVE-2025-65270 ⚠️ Disclaimer Questo repository è esclusivamente per scopi educativi e di ricerca sulla sicurezza difensiva 🔥 Panoramica Vulnerabilità di cross-site scripting riflesso XSS in ClinCapture EDC 3.0 e 2.2.3 , che consente a un attaccante remoto non autenticato di eseguire codice...

naxsi

Projektstatus Dies ist ein Projektstatus-Update bezüglich Naxsi. Wie Sie vielleicht bemerkt haben, wurde die Entwicklung von Naxsi eingestellt und das Repository wird aus historischen Gründen archiviert. Das bedeutet, dass für diese Version keine neuen Updates oder Fehlerbehebungen veröffentlicht...

cPanel-CVE-2023-29489

POC für cPanel CVE-2023-29489 XSS Payload...

CVE-2025-68116

CVE-2025-68116 Autor: @x0root Vulnerabilidade: Cross-Site Scripting XSS Armazenado via Uploads Renderizáveis pelo Navegador SVG / HTML Software Afetado: FileRise Nota: O GHSA-qrcv-vjvf-fr29 introduziu uma mitigação que impedia a renderização de SVGs na interface web do F...

CVE-2024-21338-1

CVE-2024-21338 Questo PoC è stato sviluppato per il contest XSS PWN-Day. https://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/111240/...

jsprime

Autori Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduzione Oggi, sempre più sviluppatori stanno passando a JavaScript come prima scelta di linguaggio. Il motivo è semplice: JavaScript è stato ormai accettato come linguaggio di programmazione principale per le...

CVE-2025-52357

CVE-2025-52357 : Sicherheitshinweis: XSS in der Admin-Konsole des FD602GW-DX-R410 Routers Proof of Concept und Sicherheitshinweis für eine Reflected-XSS-Schwachstelle in der Admin-Konsole des FD602GW-DX-R410 Glasfaser-Routers Firmware V2.2.14. Enthält Details, Auswirkungen und Anleitungen zur...

pythoncode-tutorials

Tutorial sul Codice Python Questo è un repository di tutti i tutorial del sito The Python Code. Elenco dei Tutorial Hacking Etico Scapy Come Iniziare con Scapy: Strumento di Manipolazione della Rete in Python Costruire un ARP Spoofer. codice Rilevare gli Attacchi ARP Spoof. codice Come Creare un...

EUVD-2026-67408

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload called without a MIME...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-18983

One User Avatar | User Profile Picture for WordPress is vulnerable to Stored Cross-Site Scripting (leading to potential remote code execution) in all versions up to and including 2.5.4 . The root cause is insufficient file type validation in wp_handle_upload(), called without a MIME allow-list; p...

CVE-2026-3129

The LiteSpeed Cache plugin for WordPress (all versions up to and including 7.7 ) is vulnerable to Stored Cross-Site Scripting via crafted tag attributes. The root cause is a flawed regular expression used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missi...

CVE-2026-18983 One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload called without a MIME...

EUVD-2026-67407

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

EUVD-2026-67404

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-18324

Forminator Forms (a WordPress plugin for building contact, payment, and custom forms) is vulnerable to Stored Cross-Site Scripting (XSS) via its Rich-Text Textarea field in all versions up to and including 1.57.0.1 . The root cause is insufficient input sanitization and output escaping , allowing...