A curated database of Universal Cross-Site Scripting (UXSS) vulnerabilities and browser security research resources.
uxss-db is a curated database of Universal Cross-Site Scripting (UXSS) vulnerabilities and browser security research materials. It compiles historical CVEs, proof-of-concepts, and technical articles to help researchers understand and mitigate browser logic flaws. The project addresses the need for a centralized, open-source reference on UXSS exploits across different browser engines.
Security researchers, bug bounty hunters, browser developers, and penetration testers focused on web application and browser security.
Developers choose uxss-db for its comprehensive, well-organized collection of UXSS vulnerabilities and related resources, which saves time in security research and vulnerability analysis compared to scattered sources.
🔪Browser logic vulnerabilities :skull_and_crossbones:
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides detailed tables of UXSS CVEs with titles, affected versions, dates, and links to reports or proof-of-concepts, as seen in the WebKit and Chromium sections, making it a centralized reference.
Includes articles, whitepapers, and browser hacking guides covering topics like Same-Origin Policy and browser architecture, offering valuable context for security analysis.
Organizes vulnerabilities by browser engine (WebKit, Chromium, IE/Edge), allowing researchers to easily target and study flaws in specific platforms.
Offers tools like `js-vuln-db-to-format.sh` to export vulnerability data into HTML or JS formats, enhancing automation and integration for further analysis.
The README admits 'Many CVEs aren't listed in the tables below!' and points to an /other folder for unsorted entries, indicating gaps and potential inaccuracies in the database.
As a static collection with no stated update schedule, it may lack recent vulnerabilities or patches, reducing its relevance for current security assessments without supplemental sources.
Focuses exclusively on UXSS vulnerabilities, missing other critical browser security issues like memory corruption or zero-days, which limits its utility for comprehensive research.
Relies on scripts that extract data from `js-vuln-db`, making it dependent on the maintenance and accuracy of that external repository, which could introduce reliability issues.