Teldat-Router-CVE-2022-POC

Enrutador Teldat CVE-2022-39996 y CVE-2022-39997 POC Prueba de concepto para dos vulnerabilidades descubiertas en los enrutadores Teldat RS123 / RS123w. Resumen ID CVE| Tipo| CWE| CVSS| Gravedad ---|---|---|---|--- CVE-2022-39996| XSS Reflejado| CWE-79| 6.1| Media CVE-2022-39997| Contraseña Débil...

CVE-2026-5513

CVE-2026-5513 — Bookly ≤ 27.2 存储型XSS（通过Cookie） 概述 字段| 值 ---|--- CVE ID| CVE-2026-5513 漏洞类型| 存储型跨站脚本（XSS） 插件| Bookly — 在线日程安排与预约预订系统 受影响版本| ≤ 27.2 修复版本| 27.3+ CVSS 3.1| 7.2（高危） — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CWE| CWE-79 是否需要认证| 无 前提条件| 记住个人Cookie信息 必须 启用 （默认禁用） 描述 WordPress 的 Bookl...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2021-31761

CVE-2021-31761 描述： 通过 Webmin 的运行进程功能，利用反射型跨站脚本（XSS）攻击实现远程命令执行（RCE） 测试版本： Webmin 1.973（GitHub 最新版本 2021年3月7日） 攻击类型： 远程 影响： 远程命令执行 漏洞利用 POC 代码： YouTube POC： https://youtu.be/23VvUMu-28c 产品供应商： https://www.webmin.com 附加信息： "Webmin 是一款基于 Web 的 Unix 类服务器和服务系统管理工具，全球安装量超过 100...

BurpSentinel

Burp Sentinel 简化发现 Web 应用程序中常见安全漏洞的过程。 介绍/教程：https://github.com/dobin/BurpSentinel/wiki/BurpSentinel---HowTo-and-introduction 博客：http://dobin.github.io/ 借助 BurpSentinel，渗透测试人员可以快速轻松地向 HTTP 请求的参数发送大量恶意请求。不仅如此，它还会根据攻击请求显示大量 HTTP 响应信息。这样很容易发现低级漏洞和隐藏漏洞，并让测试人员能够专注于更重要的事情！ 功能 内置攻击载荷 识别反射型 XSS 和存储型 XSS ...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

EUVD-2024-55747

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

EUVD-2026-70047

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83547

Xpro Addons (WordPress plugin) versions 1.6.0 through 1.7.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain widget settings are not properly escaped before being rendered within HTML attributes . An attacker with the Contributor role or higher can inject malic...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-82884

The All in One SEO WordPress plugin before 5.0.0.1 fails to sanitise and escape content stored in the ai-assistant Block within posts before rendering it in the post editor. This allows users with the contributor role or higher to inject a Stored Cross-Site Scripting (XSS) payload that executes w...

EUVD-2026-70045

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2025-15692 Icegram Express < 5.8.6 - Admin+ Stored XSS

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15692

CVE-2025-15692 affects the Icegram Express WordPress plugin prior to version 5.8.6 . The root cause is improper escaping of a list description setting before it is output within an HTML attribute , enabling Stored Cross-Site Scripting (XSS) attacks. Exploitation requires an authenticated user wit...

CVE-2025-15692 Icegram Express < 5.8.6 - Admin+ Stored XSS

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2025-210828

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...