CVE-2024-2876

CVE-2024-2876 针对 Icegram express 中 SQLi 漏洞的概念验证代码 法律免责声明 本仓库中提供的概念验证（PoC）脚本仅用于教育和研究目的。其目的是展示特定漏洞并帮助理解相关安全风险。 任何将此脚本用于未经授权活动的行为，包括但不限于未经授权的系统访问、未经授权的测试或其他形式的滥用，均被明确禁止。 本仓库的创建者和贡献者不对因使用或不当使用此脚本而导致的任何损害或损失承担任何责任。使用此脚本即表示您同意以负责任的方式自行承担风险。...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

InstagramMutualFollowerChecker

Instagram 互关粉丝检查器 一个基于 Node.js/Express 的 Web 应用，通过抓取关注者数据来检查 2 个或更多 Instagram 账号间的互关关系。 功能特性 ✅ 检查多个 Instagram 账号间的互关粉丝 ✅ 支持公开账号以及你关注的私密账号 环境要求 Node.js v12 或更高版本 npm 或 yarn 安装步骤（在终端中输入） 1. 克隆项目： git clone https://github.com/OscarFromNZ/InstagramMutualFollowerChecker 2. 进入项目目录： cd...

VulnNodeApp

VulnNodeApp 一个使用 node.js、express 服务器和 ejs 模板引擎构建的漏洞应用程序。此应用程序仅用于教育目的。 设置 克隆此仓库 git clone https://github.com/4auvar/VulnNodeApp.git 应用程序设置： 安装最新版本的 node.js 和 npm。 打开终端/命令提示符，导航到下载/克隆的仓库所在位置。 运行命令：npm install 数据库设置 安装并配置最新版本的 mysql，并启动 mysql 服务/守护进程。 使用 root 用户登录 mysql，并运行以下 sql 脚本： CREATE USER...

CSS-Keylogging

CSS 键盘记录器 利用 CSS 键盘记录功能的 Chrome 扩展和 Express 服务器。 使用方法 设置 Chrome 扩展 1. 下载仓库 git clone https://github.com/maxchehab/CSS-Keylogging 2. 在浏览器中访问 chrome://extensions（或点击 Chrome 菜单最右侧的三横图标，选择“更多工具”下的“扩展程序”）。 3. 确保右上角的“开发者模式”复选框已勾选。 4. 点击“加载已解压的扩展程序”，弹出文件选择对话框。 5. 选择你下载仓库目录中的 css-keylogger-extension 文件夹。...

CVE-2026-96607

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...

CVE-2026-96607 WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...

EUVD-2026-95626

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...

CVE-2026-96607

The Basix NEX-Forms nex-forms-express-wp-form-builder WordPress plugin (versions n/a through 9.3.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . This flaw is caused by the improper neutralization of input during web page generation . While the documents confirm the existence of the vu...

SucoshScanny

Sucosh Scanny "Sucosh" 是一个自动化源代码漏洞扫描器（SAST）和评估框架，适用于 Python（Flask-Django）和 NodeJs，能够在 Web 应用程序开发或源代码分析过程中进行代码审查。它可以检测给定源代码中的大量漏洞（RCE、SSTI、不安全的反序列化、SSRF、SQLI、CSRF 等）。目前只完成了 Python（Flask、Django）和 NodeJs（Express JS.）语言的检测模块。未来将会为 PHP（Laravel、Codeigniter）、.NET、Go 和其他语言编写特定的检测函数。 示例用法 扫描源代码分析 例如：pytho...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Icegram Express 的 Email Subscribers 插件 editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

TarantuBench

TarantuBench v1 一个用于评估AI代理在网络安全挑战中表现的基准测试，由TarantuLabs引擎生成。 这是什么？ TarantuBench 包含100个存在漏洞的Web应用程序，每个都隐藏着一个flag（TARANTU...）。代理的任务是通过HTTP与应用程序交互来找到并提取flag——就像人类渗透测试员一样。 挑战范围从初级的SQL注入登录绕过，到需要依次利用多达5个漏洞的高级多步骤攻击链——包括业务逻辑滥用、存储型XSS窃取会话、JWT伪造、SSRF以及内部API上的SQL注入。...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

Express-handlebars - Local File Inclusion

Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

PT-2026-108862

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

Security Bulletin:qs.stringify TypeError: obj.constructor.isBuffer is not a function when serializing objects with own constructor.isBuffer property

Summary Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as...

CVE-2026-80821

A flaw was found in the Linux kernel's nvmet PCI Express Endpoint Function PCI-EPF component. A remote attacker can exploit this vulnerability by sending specially crafted Create IO Completion Queue CQ commands. This leads to a resource leak, as the system fails to properly release references to...

CVE-2023-25813-TEST

CVE Test App Sequelize CVE-2023-25813 동작을 로컬에서 확인하기 위한 Express + MySQL 실습 앱입니다. 이 프로젝트는 의도적으로 취약한 Sequelize 버전과 취약한 로그인 쿼리 패턴을 유지합니다. 인터넷에 노출하지 말고 로컬 Docker 실습 환경에서만 실행하세요. 配置 Web: Express, EJS DB: MySQL 8.0 ORM: Sequelize 6.19.0 Docker DB 포트: localhost:3307 Web 포트: localhost:3000 主要功能： 注册 登录/登出...