Curated security research, vulnerabilities, advisories and tools for practitioners.

#xss

Security coverage tagged xss.

1.

How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs

vulnerability | 2026-10-20 07:48 | yeswehack.com | Original ↗ | .md | #data-exposure | #xss | #idor

2.

Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta

research | 2026-10-15 20:10 | yokai.hakaisecurity.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #account-takeover

3.

Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion

research | 2026-10-15 20:09 | yokai.hakaisecurity.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #account-takeover

4.

From XSS to RCE: Two Exploit Chains in ConcreteCMS

vulnerability | 2026-10-04 00:00 | tenzai.com | Original ↗ | .md | #rce | #web-security | #xss

5.

Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)

tool | 2026-09-25 00:13 | CVE-2026-93485 | github.com | Original ↗ | .md | #bug-bounty | #rce | #zero-day

6.

CVE-2026-78902: XSS to RCE in pfSense with one DNS request

vulnerability | 2026-09-22 00:00 | CVE-2026-78902 | netspi.com | Original ↗ | .md | #rce | #xss | #vulnerability-analysis

7.

What's in a tag name? JavaScript, apparently

research | 2026-08-25 14:24 | portswigger.net | Original ↗ | .md | #browser-security | #web-security | #xss

8.

Yet another RCE in Gogs, but it's fixed this time!

vulnerability | 2026-08-19 00:00 | aikido.dev | Original ↗ | .md | #rce | #gitlab | #xss

9.

XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)

vulnerability | High | 2026-08-07 15:25 | CVE-2026-64638 | pwn.ai | Original ↗ | .md | #ai-security | #rce | #public-poc

10.

Supply Chain Security Analysis of a 9.5M-Install VS Code Extension

vulnerability | 2026-08-16 13:08 | projectdiscovery.io | Original ↗ | .md | #bug-bounty | #supply-chain | #xss

11.

CRLF-Powered Desync Attacks: Beheading HTTP Streams

research | 2026-08-05 23:30 | portswigger.net | Original ↗ | .md | #vulnerability-research | #attack-chains | #web-security

12.

PimpMyCaido #1: Hunt client-side vulnerabilities with DOMLogger++

blog | 2026-08-06 07:47 | yeswehack.com | Original ↗ | .md | #bug-bounty | #web-security | #xss

13.

Finding eight high-severity vulnerabilities in NodeBB in six hours

research | 2026-07-22 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #featured | #vulnerability-research

14.

Rickrolling the World Cup, unleashing AI across Google, 0-click stored XSS on Next.js – ethical hacker roundup

blog | 2026-07-21 08:36 | yeswehack.com | Original ↗ | .md | #ai-security | #vulnerability-research | #github

15.

How to use Claude Code for Bug Bounty: find fast, validate manually

blog | 2026-07-17 07:14 | yeswehack.com | Original ↗ | .md | #ai-security | #bug-bounty | #pentesting

16.

Web2 Bugs Hiding in Web3: The Smart Contract Security Blind Spot

blog | 2026-07-10 09:55 | hackenproof.com | Original ↗ | .md | #supply-chain | #web3 | #vulnerability-research

17.

How LLMs are changing Bug Bounty: An interview with Rhynorater

blog | 2026-06-30 11:21 | yeswehack.com | Original ↗ | .md | #ai-security | #bug-bounty | #claude-code

18.

CVE-2026-45453 — Microsoft SharePoint Server Workflow Pages DocURL Parameter Reflected Cross-Site Scripting

research | 2026-06-16 00:00 | CVE-2026-45453 | aretiq.ai | Original ↗ | .md | #appsec | #vulnerability-research | #xss

19.

Vulnerability Tutorial: How to bypass CSP

blog | 2026-06-11 10:28 | hackenproof.com | Original ↗ | .md | #web-security | #xss | #tutorial

20.

How to hack into NFT marketplace

blog | 2026-06-11 10:27 | hackenproof.com | Original ↗ | .md | #bug-bounty | #web3 | #web-security

21.

HackenProof Customer Story: Uklon

blog | 2026-06-05 10:28 | hackenproof.com | Original ↗ | .md | #bug-bounty | #xss | #idor

22.

Roundcube XSS chained with cookie tossing for full inbox access

blog | 2026-04-21 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #attack-chains | #web-security

23.

Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow

research | 2026-04-17 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #account-takeover | #xss

24.

LibreNMS < 26.3.0 Authenticated RCE & XSS

research | 2026-04-13 10:24 | projectblack.io | Original ↗ | .md | #rce | #web-security | #xss

25.

From Report to Remediation: A Real-World XSS Validation Workflow

blog | 2026-04-14 20:07 | hackerone.com | Original ↗ | .md | #remediation | #continuous-testing | #automation

26.

Aikido Attack finds multiple 0-days in Hoppscotch

research | 2026-04-08 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #zero-day | #account-takeover

27.

How to Find XSS: Techniques Security Researchers Use in Real Environments

research | 2026-04-01 16:00 | hackerone.com | Original ↗ | .md | #bug-bounty | #pentesting | #web-security

28.

Patch gap to mobile renderer RCE: pwning Samsung Internet’s V8 on the Galaxy S25

research | 2026-04-01 12:00 | CVE-2025-10891 | osec.io | Original ↗ | .md | #rce | #xss | #mobile-security

29.

HTTP/1.1 Must Die: Conquering the 0.CL Challenge

blog | 2026-03-13 09:21 | portswigger.net | Original ↗ | .md | #appsec | #burp-suite | #web-security

30.

Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

research | 2026-03-11 00:00 | hunt.io | Original ↗ | .md | #ai-security | #threat-intelligence | #malware