Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
leaflet-cve-2025-69993 — Proof-of-concept for CVE-2025-69993: Cross-Site Scripting in Leaflet's bindPopup() method. Includes advisory, impact analysis, and a demo Angular application to reproduce the vulnerability. | Kitploit
Tools/GitHubGitHub/pierfrancescoconti/leaflet-cve-2025-69993
Vulnerability AnalysisWeb Application ExploitationWeb SecurityLearning & EducationLabs & Practice
GitHubpierfrancescoconti/leaflet-cve-2025-69993

leaflet-cve-2025-69993

Proof-of-concept for CVE-2025-69993: Cross-Site Scripting in Leaflet's bindPopup() method. Includes advisory, impact analysis, and a demo Angular application to reproduce the vulnerability.

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-69993 — XSS in Leaflet bindPopup()

Cross-Site Scripting vulnerability in Leaflet <= 1.9.4. The bindPopup() method renders user-supplied input as raw HTML without sanitization, allowing arbitrary JavaScript execution.

Repository Structure

  • ADVISORY.md — Full security advisory with vulnerability details, impact analysis, and recommended mitigations
  • leaflet-xss-poc/ — Angular application that demonstrates the vulnerability in a realistic scenario (user form input passed directly to bindPopup())

Quick Start

root@kitploit:~
cd leaflet-xss-poc
npm install
npm start

Open http://localhost:4200/, enter `` in the Description field, and click "Add Marker".

Download Tool