166 matches found
JS Secret Hunter 2
JS Secret Hunter is an advanced Python tool designed for security researchers to automate the detection of hardcoded secrets in client-side JavaScript. Unlike simple scanners, V2 includes a dynamic crawler that parses the HTML of the target website to extract all loaded JavaScript files...
Newgen OmniApp security vulnerability
Newgen OmniApp is a mobile application development framework provided by the American company Newgen. Newgen OmniApp has a security vulnerability, which stems from the ability to enumerate valid privileged user names through publicly accessible client-side JavaScript resources, potentially leadin...
PT-2026-4473
Name of the Vulnerable Software and Affected Versions Newgen OmniApp affected versions not specified Description An unauthenticated information disclosure issue exists in Newgen OmniApp. This allows attackers to identify valid privileged usernames through a publicly accessible client-side...
Open Redirect
React Router is vulnerable to Open Redirect. The vulnerability is due to unsafe handling of SPA navigation redirects generated from loaders or actions in certain modes, which allows an attacker to inject untrusted redirect URLs and trigger unintended JavaScript execution on the client...
CVE-2024-39332
Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server...
CVE-2026-22230
OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. Fixed in eCASE Platform 11.14.1.0...
PT-2026-2172
Name of the Vulnerable Software and Affected Versions OPEXUS eCASE Audit versions prior to 11.14.1.0 Description An authenticated attacker can modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. The issue...
@clidey/dory (0.35.0), @garage44/bunchy (>=2.0.0, <=2.1.12) +15 more potentially affected by CVE-2026-22028 via preact (>=10.26.5, <=10.26.9)
preact NPM version =10.26.5, =2.0.0, =1.0.5, =3.0.0, =2.0.0, =19.0.0, =19.0.0, =19.0.0, =1.1.6, =5.14.0, =0.0.105, =0.0.105, =0.0.2, =0.0.109, =0.0.110 and more Source cves: CVE-2026-22028 Source advisory: SNYK:JS-PREACT-14897824...
CVE-2025-63883
A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 Bhabishya-123/E-commerce. The site's client-side JavaScript reads attacker-controlled input for example, values derived from the URL or page fragment and inserts it into the DOM via unsafe sinks...
CVE-2025-64308
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle...
CVE-2025-64308
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...
CVE-2025-64308: Unprotected Transport of Credentials
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...
Brightpick Mission Control security vulnerability
Brightpick Mission Control is a centralized control platform for mission management from Brightpick USA. A security vulnerability exists in Brightpick Mission Control that stems from the inclusion of hard-coded credentials in a client-side JavaScript package...
CVE-2025-64308
Brightpick Mission Control web application exposes hardcoded credentials in the client-side JavaScript bundle. The vulnerability can enable unauthorized access to credentials and could allow manipulation of robot control functions through an unauthenticated interface and via WebSocket traffic, pe...
EUVD-2025-197665
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle...
WordPress plugin eRoom security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...
CVE-2025-56800
Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable...
EUVD-2025-35227
Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable...