1048543 matches found
joomla_exploits
Joomla 漏洞利用 本仓库包含精选的 Joomla 漏洞利用工件，这些工件已针对真实的 Docker Joomla 环境进行验证。该集合按实际攻击效用分类。 real-impact 实际影响 具有直接安全影响的漏洞利用：RCE、文件上传导致代码执行、SQL 注入、敏感配置泄露、任意文件删除、针对管理员的存储型 XSS 或权限提升。...
CVE-2026-81201
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...
CVE-2026-81160
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
CVE-2026-18986
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...
CVE-2023-44758_GDidees-CMS-Stored-XSS---Title
GDidees 保存型XSS v3.0 作者: Sergio 説明: GDidees v.3.0のクロスサイトスクリプティング脆弱性により、ローカル攻撃者がページタイトルに細工されたスクリプトを介して任意のコードを実行できます。 攻撃ベクトル: スクリプティング - ページタイトル内の入力のサニタイズにおける脆弱性により、ユーザーがWebページにアクセスしたときに実行されるJavaScriptコードを注入できます。 概念実証 POC: 「Outils d'édition」を編集すると、「Titre de la page」に任意のJavaScriptコードを注入できることがわかります。...
-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options
Evolution CMS XSS Reflejado v3.2.3 Autor: Sergio Descripción: Múltiples vulnerabilidades de Cross-site scripting XSS reflejado en el proceso de instalación de evolution v.3.2.3, opciones de administración, permiten a un atacante local ejecutar scripts web arbitrarios mediante un payload manipulad...
CVE-2023-49540
CVE-2023-49540 Book Store Management System v1.0 - Cross-site scripting XSS vulnerability in /index.php/history - vulnerable field: "Customer's Name". Description : Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in /bsmsci/index.php/history. T...
EUVD-2026-69994
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...
CVE-2026-18986
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Drupal Entity Browser contrib module (versions 0.0.0 through 2.16.0 ). The root cause is insufficient sanitization of tab titles , allowing an attacker with sufficient privileges to inject malicious HTML with specific attributes on a...
bugbounty_tools
bugbountytools 用于漏洞赏金工作期间使用的脚本和工具集合。这里将存放我为个人使用而创建的自动化脚本，偶尔也会公开发布 联系方式： 如有问题、评论或请求，请在我的 X 账号（不要通过私信）发帖，我会尽力回复 https://x.com/thedawgyg 当前工具： thcrecon.py - 使用 THC 子域名查找 API，为给定的 IP/IP 范围/根域名获取子域名的脚本。 thclivecheck.py - 为 thcrecon.py 设计的辅助工具，将获取生成的域名列表并找出这些主机上的活跃 Web 服务器。 即将推出的工具： xsshunter.py -...
xss-payload-list
xss-payload-list 🎯 跨站脚本（XSS）漏洞 Payload 列表...
osticket-stored-xss-security-assessment
CVE-2026-36214 - osTicket 存储型 XSS（通过 Bootstrap Tooltip） 顾问式网络安全报告 针对 osTicket 存储型跨站脚本的专业漏洞评估报告，包括业务影响、修复及缓解策略。 📍 报告快照 字段| 详情 ---|--- 报告类型| 漏洞评估报告 参与背景| 安全研究 主要关注点| Web 应用程序安全 受众| 安全团队、工程团队、招聘经理 输出风格| 高管摘要、技术分析、业务影响、修复路线图 发布状态| 已脱敏，供公开作品集审阅 !IMPORTANT 本报告已特意脱敏，以便在 GitHub...
CVE-2026-81201
Drupal Monster Menus (a contrib module for creating multisite page structures with granular permissions) is affected by a Stored XSS vulnerability in versions 0.0.0 through 9.5.3. The root cause is insufficient sanitization of HTML code in page names when rendered in the module's built-in tree br...
EUVD-2026-69997
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...
CVE-2026-81160
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Slick UI sub-module of the Drupal Slick Carousel contrib module. The root cause is insufficient validation of user input within Slick option sets that may contain HTML for carousel buttons, allowing attackers to inject malicious scri...
EUVD-2026-69996
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
CVE-2026-84803
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...