260 matches found
Vitejs-exploit
Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Muhammad Waseem. Usage: python viteexploit.py -u http://target.com python viteexploit.py...
Vite-CVE-2025-30208-EXP
CVE-2025-30208 Detection Tool Vulnerability Analysis CVE-2025-30208 is an arbitrary file read vulnerability in the Vite development server. Attackers can read sensitive server files such as /etc/passwd or C:\windows\win.ini by constructing special paths e.g., @fs prefix. This tool supports...
CVE-2025-31486-Simulation
Vite Path Traversal Lab CVE-2025-31486 A hands-on, containerized lab environment to simulate and exploit the Path Traversal vulnerability in Vite's development server, identified as CVE-2025-31486. š About The Vulnerability This lab demonstrates a significant Path Traversal vulnerability found in...
CVE-2021-40978
CVE-2021-40978 mkdocs built-in dev-server directory traversal exploitation Mkdocs 1.2.2 allows directory traversal through the built-in dev-server which responds on port 8000. There is below some examples of successfully exploited paths: Impact Using this tecnique it is possible to fetch files...
ViteVulScan
ViteVulScan Vulnerability Introduction This project covers 3 vulnerabilities: CVE-2025-30208, CVE-2025-31125, CVE-2025-31486. All are arbitrary file reading vulnerabilities in the Vite development server. These three vulnerabilities have broad coverage and are easy to exploit without restrictions...
CVE-2025-55182-React-19.2.0
Exploitation Steps: 1. Download all files in this repository 2. Extract file.zip and name it rh-test 3. Run using npm run dev or yarn dev or pnpm dev or bun dev. 4. Open http://localhost:3000 in browser 5. Open a new terminal and run the command python3 react-exp.py http://localhost:3000 Follow...
NestJS DevTools Integration - Remote Code Execution
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...
CVE-2025-30208
š„ CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanner Advanced vulnerability scanner for CVE-2025-30208 with enterprise-grade features Professional penetration testing tool for Vite Arbitrary File Read vulnerability detection š Quick Start ā¢ š Features ā¢ š§ Usage ā¢ š Examples ā¢ š”ļø Securit...
CVE-2025-29927
CVE-2025-29927 in Next.js 15.2.0 How to Run: git clone https://github.com/nyctophile0969/CVE-2025-29927 cd CVE-2025-29927 npm install [email protected] npm run dev...
Path-Transversal-CVE-2025-31125-
Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Harsh Gupta. Usage: python viteexploit.py -u http://target.com python viteexploit.py -f...
CVE-2025-30208
š„ Vite Dev Server Vulnerability Scanner CVE-2025-30208 š Overview This tool scans for CVE-2025-30208, a vulnerability in the Vite Dev Server. It allows security researchers to quickly detect vulnerable instances using multiple payloads. ā” Features ā Single URL scanning -u URL ā Mass scanning from...
CVE-2026-39363
CVE-2026-39363 Vite Dev Server WebSocket Arbitrary File Read Vulnerability Vulnerability Overview Attribute| Information ---|--- CVE ID| CVE-2026-39363 GHSA ID| GHSA-p9ff-h696-f583 Vulnerability Type| Arbitrary File Read Affected Component| Vite Dev Server Affected Versions| Vite = 6.2.3...
cve-2024-3435
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...
GHSA-39W2-RJM5-CHCV Next.js has information disclosure in development server's Model Context Protocol endpoint
The Next.js development server next dev exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data ā including the project's location on disk, source code snippets...
Next.js has information disclosure in development server's Model Context Protocol endpoint
The Next.js development server next dev exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data ā including the project's location on disk, source code snippets...
NPM: Next.js has information disclosure in development server's Model Context Protocol endpoint
NPM: Next.js has information disclosure in development server's Model Context Protocol endpoint vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...
CVE-2026-106106
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...
CVE-2026-106106
The Quasar Framework contains a vulnerability in its SSR/SSG development error path where the renderSSRError() function in utils/render-ssr-error/src/index.js serializes sensitive data, including process.env , request headers, and cookies. Because the development server listens on all interfaces ...
CVE-2026-94485
The Next.js framework (versions 16.0.0 through 16.3.8 ) contains a vulnerability in the next dev development server. The server exposes a Model Context Protocol (MCP) endpoint that lacks reliable restrictions on cross-site requests . If a developer visits a malicious website while the development...
CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...