1047483 matches found
CVE-2026-54606
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...
bugbounty-cheatsheet
Prontuario Bug Bounty 📚 Riferimenti| 🔎 Vulnerabilità ---|--- Piattaforme Bug Bounty| XSS Libri| SQLi Strumenti Speciali| SSRF Ricognizione| Iniezione CRLF Piattaforme di Pratica| Iniezione CSV Suggerimenti Bug Bounty| LFI | XXE | RCE | Reindirizzamento Aperto | Crittografia | Iniezione di Templat...
XSStrike
XSStrike Fortschrittliche XSS-Erkennungssuite XSStrike-Wiki • • • • •...
the-book-of-secret-knowledge
"La conoscenza è potente, fai attenzione a come la usi! " Una raccolta di liste stimolanti, manuali, cheat sheet, blog, trucchi, one-liner, strumenti CLI/web e molto altro. 📔 Cos'è? Questo repository è una raccolta di vari materiali e strumenti che utilizzo quotidianamente nel mio lavoro. Contien...
CVE-2026-80426
FiftyOne (Voxel51) is vulnerable to stored cross-site scripting in versions before 1.21.0 . The sidebar field-information component at FieldLabelAndInfo/index.tsx passes a dataset field's description to React's dangerouslySetInnerHTML without escaping or sanitizing, making it the only raw render ...
EUVD-2026-66600
FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...
CVE-2026-80426 FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description
FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...
NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed vulnerability discovered by ? in WordPress Npm suneditor versions = 3.1.3...
CVE-2026-54606
SunEditor (lightweight WYSIWYG JavaScript editor) is vulnerable to DOM-based cross-site scripting in its Embed plugin (src/plugins/modal/embed.js). Prior to version 3.1.4 , the plugin parses attacker-controlled raw embed HTML using DOMParser; when an external [removed] element follows a valid , i...
CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...
EUVD-2026-66595
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...
bugbounty_tools
bugbountytools Collezione di script e strumenti usati durante il lavoro di bug bounty. Questa sarà la posizione dei miei script di automazione creati per uso personale e, occasionalmente, rilasciati pubblicamente Contatti: Per domande, commenti o richieste, scrivi un post sul mio account X non in...
WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...
CVE-2024-2242
CVE-2024-2242 Contact Form 7 hist...
CVE-2019-15896
CVE-2019-15896 LifterLMS = 3.34.5 - Importazione Opzioni Non Autenticata Descrizione L'importazione di opzioni non autenticata, che potrebbe portare a Reindirizzamento del sito web Creazione di un account amministratore Iniezione di contenuti Stored XSS I problemi sono stati segnalati come risolt...
django-xss-example
Verifica locale Funziona solo su linux. Su windows una delle dipendenze potrebbe causare un errore. Prima di eseguire è necessario installare i seguenti pacchetti: root@kitploit: pip install -r requirements.txt Verificare che i pacchetti siano installati root@kitploit: python -m django --version...
WordPress WP Fastest Cache plugin <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability
Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability discovered by Adrien Brunner in WordPress Plugin WP Fastest Cache versions = 1.5.0...
westone-CVE-2021-21980-scanner
westone-CVE-2021-21980-scanner Le versioni precedenti di VMware vCenter 7.0.2.00100 presentano una vulnerabilità di lettura non autorizzata di file arbitrari + ssrf + xss Installazione e Utilizzo git clone https://github.com/Osyanina/westone-CVE-2021-21980-scanner.git cd...