373 matches found
CVE-2025-30208-EXP
CVE-2025-30208-EXP Vite开发服务器任意文件读取漏洞（CVE-2025-30208），漏洞覆盖面大，利用简单且不受限制，漏洞危害巨大！ Fofa测绘语句: root@kitploit: body="/@vite/client" 鹰图Hunter测绘语句: root@kitploit: web.body="/@vite/client" Exp脚本使用方法 root@kitploit: -u 进行检测 root@kitploit: -p 自定义payload eg. /etc/passwd root@kitploit: -d 可以使用字典进行fuzz测试 不走代理使用本E...
CVE-2026-39363
CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...
CVE-2025-30208
English | 中文 Vite Dev Server Vulnerability Scanner 一个用于扫描 Vite 开发服务器漏洞的自动化工具。该工具利用 FOFA API 收集潜在目标，并自动检测是否存在特定漏洞。 漏洞介绍 CVE-2025-30208 漏洞编号：CVE-2025-30208 漏洞名称：Vite 开发服务器未授权访问 漏洞描述：Vite 开发服务器存在未授权访问漏洞，攻击者可以通过特定的 URL 访问敏感信息。 漏洞影响：Vite 版本 =6.2.0, =6.1.0, =6.0.0, =5.0.0, =6.2.0, =6.1.0, =6.0.0, =5.0....
Vite - Path Traversal
Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network an...
Vite Dev Server - Path Traversal in Optimized Deps .map Handling
Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...
Vite Dev Server - Information Exposure
Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...
CVE-2025-30208
🔥 CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanner Advanced vulnerability scanner for CVE-2025-30208 with enterprise-grade features Professional penetration testing tool for Vite Arbitrary File Read vulnerability detection 🚀 Quick Start • 📋 Features • 🔧 Usage • 📊 Examples • 🛡️ Securit...
CVE-2025-30208-template
CVE-2025-30208-template CVE-2025-30208 vite file read nuclei template Query HUNTER : http://product.name="Vite" FOFA : body="/@vite/client" SHODAN ：http.html:"/@vite/client" Run Nuclei Template root@kitploit: nuclei -l target.txt -t CVE-2025-30208.yaml...
CVE-2025-30208-Series
CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...
CVE-2025-30208-31125-31486-32395
Guía de explotación de vulnerabilidades de Vite CVE-2025-30208/31125/31486/32395 Este documento resume los métodos de explotación de cuatro vulnerabilidades de lectura arbitraria de archivos en el servidor de desarrollo de Vite, incluidos ejemplos para sistemas Linux y Windows. Tenga en cuenta:...
Vite server.fs.deny Bypass - Local File Inclusion
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...
CVE-2025-30208
CVE-2025-30208 — Lectura arbitraria de archivos en Vite · v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w Severidad: CVSS 5.3 Media servidor de desarrollo accesible por red ⚠ Solo para pruebas de seguridad autorizadas. El uso no autorizado contra sistemas que no posee o para los que no tiene...
CVE-2025-30208
CVE-2025-30208 Usando una cadena de consulta de importación raw especial en un servidor de desarrollo de Vite, un atacante puede leer archivos arbitrarios Resumen del CVE Los servidores de desarrollo de Vite anteriores a 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10 pueden eludir las comprobaciones de...
CVE-2025-30208-PoC
CVE-2025-30208 - PoC de Lectura Arbitraria de Archivos en Vite Este es un script de Prueba de Concepto PoC para explotar CVE-2025-30208, permitiendo lecturas arbitrarias de archivos en servidores de desarrollo de Vite. Detalles de la Vulnerabilidad Vite, un proveedor de herramientas de desarrollo...
CVE-2025-30208
🔥 Scanner di Vulnerabilità del Server di Sviluppo Vite CVE-2025-30208 🚀 Panoramica Questo strumento scansiona per CVE-2025-30208, una vulnerabilità nel Server di Sviluppo Vite. Permette ai ricercatori di sicurezza di rilevare rapidamente istanze vulnerabili utilizzando multipli payload. ⚡...
CVE-2025-11953-PoC
الوصف خادم التطوير Metro، الذي يفتحه واجهة أوامر React Native Community CLI، يرتبط بالواجهات الخارجية افتراضيًا. يعرّض الخادم نقطة نهاية معرضة لحقن أوامر نظام التشغيل. وهذا يسمح لمهاجمي الشبكة غير المصادق عليهم بإرسال طلب POST إلى الخادم وتشغيل ملفات تنفيذية عشوائية. على نظام Windows، يمكن...
CVE-2026-39363
CVE-2026-39363 — Vite Dev Server WebSocket Beliebige Datei-Lesen Massen-Scanner Haftungsausschluss: Dieses Tool ist ausschließlich für autorisierte Sicherheitstests und Bildungsforschung bestimmt. Benutzer müssen die lokalen Gesetze und Vorschriften einhalten. Das Scannen oder Angreifen fremder...
ROOT-APP-NPM-CVE-2026-6402 CVE-2026-6402 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-6402 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...