of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

Corsy

Corsy CORS Misconfiguration Scanner Introduction Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations. Requirements Corsy only works with Python 3 and has just one dependency: requests To install this dependency, navigate to Corsy directory and execute...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

halo-cve-2026-67919

URL からの halo プラグイン RCE halo のコンソールでは、管理者が URL を貼り付けてプラグインをインストール/アップグレードできます。 任意の URL をフェッチし、jar をインストールして、その jar のコードがサーバー上で実行されます。 スキームのチェックもホストのチェックもなく、リダイレクトも追跡され、 プラグインマネージャーは jar から拡張クラスを直接ロードします。 これは CVE-2026-67919（install-from-uri / upgrade-from-uri）、 CVE-2026-67920（migration...

CORStest

CORStest A simple CORS misconfiguration scanner Based on the research ofJames Kettle CORStest is a quick & dirty Python 3 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following...

CVE-2025-55462

CVE-2025-55462 Vulnerability Summary A Cross-Origin Resource Sharing CORS misconfiguration was identified in Eramba Community and Enterprise Editions v3.26.0. The application reflects attacker-controlled Origin headers in the Access-Control-Allow-Origin response header on the /system-api/login...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF leading to RCE This bug allows a remote website to create and start an arbitrary docker container on machines running Che before versions 7.3.0 and 7.4.1 when a user visits a webpage. Vulnerability This is a CSRF bug that allows a remote website to create and start...

CVE-2025-34291_cors_security_scanner

CVE-2025-34291corssecurityscanner A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin Resource Sharing CORS misconfigurations - CVE-2025-34291. CORS Security Scanner A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin...

CVE-2019-9580

CVE-2019-9580 - StackStorm exploiting CORS null origin to gain RCE Prior to 2.10.3/2.9.3, if the origin of the request was unknown, we would return null. null can result in a successful request from an unknown origin in some clients. Allowing the possibility of XSS style attacks against the...

Astra

Astra Тестирование безопасности REST API на проникновение сложно из-за постоянных изменений существующих API и добавления новых. Astra может использоваться инженерами по безопасности или разработчиками как неотъемлемая часть их процесса, чтобы они могли обнаруживать и устранять уязвимости на ранн...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - version 2020.7 An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcar...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – CORS設定ミスによる認証済みデータ漏洩 📌 アドバイザリ参照情報 CVE ID: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 ベンダー: karnop 製品: realtime-collaboration-platform 深刻度: HIGH CVSS 7.4 ベクトル: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N 🧠 脆弱性の概要 realtime-collaboration-platform プロジェクトには、Appwriteバックエンド設定におけるCORS設定ミス...

CVE-2020-10132

CVE-2020-10132 - CVE-2020-10132 - SearchBlox product before V-9.1 is vulnerable to CORS misconfiguration. Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total...

langflow-cors-scanner

CVE-2025-34291 — Langflow 출처 검증 / CORS 개요 과도하게 허용적인 CORS 구성과 리프레시 토큰 쿠키 구성이 결합되어 자격 증명 도난이 가능합니다. 필드| 값 ---|--- CVE| CVE-2025-34291 심각도| 높음 제품| Langflow CISA KEV| 2026-05-21 공격 유형| 출처 검증 / CORS 인증 필요| 없음 영향을 받는 버전 상태| 버전 ---|--- ❌ 취약| 1.3.5 이전의 Langflow 버전 ✅ 수정됨| Langflow 1.3.5+에서 수정됨 설치 Clone gi...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS 오설정 + CSRF 보호 우회 결합 공격 요약 Halo CMS 2.25.4 이하 버전에는 두 가지 보안 오설정으로 인한 심각한 결합 공격 취약점이 존재합니다: 1. CORS 오설정 : CORS 정책이 credentials: true와 함께 모든 오리진을 허용합니다. 2. CSRF 보호 우회 : 모든 API 엔드포인트/api/, /apis/가 CSRF 보호에서 제외됩니다. 이 두 가지가 결합되면, 공격자는 CORS가 강제하도록 설계된 Same-Origin Policy 보호를...

CVE-2026-27579-CollabPlatform-Appwrite-CORS-Misconfiguration

Appwrite CORS 오작동 악용 PoC CVE-2026-27579 – 허용적인 CORS로 인한 인증된 계정 데이터 유출 CVE-2026-27579 GHSA-qh5m-p8jh-hx88 realtime-collaboration-platform에서 사용하는 Appwrite 백엔드의 심각한 CORS 오작동으로 인해, 공격자가 제어하는 오리진이 인증된 사용자의 민감한 데이터이메일, 사용자 ID, MFA 상태 등를 자격 증명이 포함된 교차 오리진 요청을 통해 로그인한 피해자로부터 읽을 수 있습니다. 영향을 받는 소프트웨어 프로젝트 ...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker containing a vulnerability in the rabbit_mgmt_cors.erl component. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6 , the match_origin/1 function incorrectly reflected the request Origin while allowing credentials when a wildcard (*) was configured....