Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-5615 — Python proof-of-concept for CVE-2026-5615, a stored XSS in VvvebJs, demonstrating SVG upload exploitation with multi-threaded scanning and validation. | Kitploit
Tools/GitHubGitHub/sahmsec/cve-2026-5615
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubsahmsec/cve-2026-5615

CVE-2026-5615

Python proof-of-concept for CVE-2026-5615, a stored XSS in VvvebJs, demonstrating SVG upload exploitation with multi-threaded scanning and validation.

View Repository
3 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-5615 — VvvebJs Stored Cross-Site Scripting (RXSS)

Overview

This repository contains a Python proof-of-concept (PoC) script demonstrating a Stored Cross-Site Scripting (RXSS) vulnerability affecting VvvebJs <= v2.0.5.

⚠️ This project is intended strictly for authorized security testing, educational research, and defensive validation only.

Vulnerability Information

  • CVE ID: CVE-2026-5615
  • Affected Software: VvvebJs
  • Affected Versions: <= 2.0.5
  • Issue Type: Stored Cross-Site Scripting (RXSS)
  • Severity: High
  • CVSS: 8.5
  • Attack Vector: Remote

The vulnerability allows attackers to upload crafted SVG content containing executable JavaScript, which may later execute in a victim’s browser when the uploaded file is viewed.

Features

  • Multi-threaded target processing
  • Automatic SVG upload validation
  • Colored terminal output
  • Successful target logging
  • Batch target support

Requirements

  • Python 2.7
  • requests library

Install dependency:

root@kitploit:~
pip install requests

Files

FileDescription
CVE-2026-5615.pyMain PoC script
CVE-2026-5615.txtExample target list
CodeB0ss-CVE-2026-5615_Exploited.txtSuccessful results output

Usage

Prepare a text file containing target URLs:

root@kitploit:~
https://example.com
https://target-site.com

Run the script:

root@kitploit:~
python2 CVE-2026-5615.py

When prompted:

root@kitploit:~
 - [WEBLIST] > targets.txt

Output

Successful Targets

Successful results are saved to:

root@kitploit:~
CodeB0ss-CVE-2026-5615_Exploited.txt

Terminal Status Messages

StatusMeaning
ExploitedTarget appears vulnerable
Not_VulnerableUpload validation failed
Cant_AccessEndpoint inaccessible
Time0utRequest timed out

How It Works

The script:

  1. Reads target URLs from a file
  2. Attempts to upload a crafted SVG file
  3. Sends the payload using multipart form-data
  4. Checks whether the uploaded SVG becomes publicly accessible
  5. Verifies payload reflection and upload success

Disclaimer

This repository is provided for:

  • Security research
  • Educational purposes
  • Authorized penetration testing
  • Defensive security assessments

Do not use this project against systems you do not own or have explicit permission to test.

The author assumes no responsibility for misuse or damages caused by this project.

Mitigation Recommendations

Website administrators should:

  • Upgrade VvvebJs to a patched version
  • Disable dangerous SVG uploads
  • Sanitize uploaded SVG content
  • Enforce strict MIME type validation
  • Deploy Content Security Policy (CSP)
  • Monitor upload directories for suspicious files
  • Restrict public access to uploaded assets where possible

Educational Purpose Statement

This proof-of-concept was created to help:

  • Security researchers
  • Penetration testers
  • Developers
  • Blue teams
  • System administrators

understand the risks associated with insecure file upload handling and stored XSS vulnerabilities.

References

  • CVE Database
  • OWASP XSS Prevention Cheat Sheet
  • OWASP File Upload Security Guidelines
  • VvvebJs Security Advisories

Author

Security Research / Educational Project

Download Tool