122 matches found
CVE-2023-4357-Chrome-XXE
Tool Introduction The world's first single file exploits the CVE-2023-4357 Chrome XXE vulnerability EXP, allowing attackers to obtain local files of visitors. The world's first single file exploits the CVE-2023-4357 Chrome XXE vulnerability EXP, allowing attackers to obtain local files of visitor...
CVE-2019-0678
Vulnerability Microsoft Edge Elevation of Privilege Vulnerability Vulnerability Description This vulnerability allows an attacker to execute javascript code on every host without the permission, also an attacker can steal local system files, and this also results in changing internal developer...
CVE-2022-3656
Imperva Red Team recently revealed a vulnerability called CVE-2022-3656 that affects more than 2.5 billion users of Google Chrome and Chromium-based browsers. This vulnerability allows the theft of sensitive files, such as encrypted wallets and cloud provider credentials. Vulnerability...
MAL-2026-14028 Malicious code in alelo-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1fd03e0ca4d5452b6a5d6aa2880a9c711021e287eaae056e68f70f6aedc926 On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to...
MAL-2026-13375 Malicious code in app-api-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2be81204ed300a759662ca3315431eec9dbb11392232f04cc58d1a815fb94b4 On npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it...
PYSEC-2026-1318 DSPy does not properly restrict file reads
The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class...
MAL-2026-6275 Malicious code in @ts-apis/ts-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccf08a9ba188be941f42f0b088d51fc5b1e84802fe9bd1d1218a6b71a6e2c11 The published tarball's dist/index.js contains an obfuscated payload that runs at require time inside a setTimeout-wrapped IIFE, completely unrelated...
CVE-2025-66608
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
CVE-2025-66608
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
CVE-2025-66608
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
CVE-2025-66608
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
CVE-2025-66608
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
CVE-2025-66608
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
CVE-2025-66608: Path Traversal: '\..\filename'
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVR...
PT-2026-7056
Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description The software does not properly validate URLs, potentially allowing an attacker to steal files from the web server by sending specially crafted requests. Recommendations Update to a version...
📄 Novell GroupWise 8.0 Traversal / Code Injection
Proof of concept exploit for an older vulnerability from 2012 that looks for a directory traversal vulnerability in Novell GroupWise version 8.0 before Support Pack 3 and attempts to upload a webshell if possible...
CVE-2026-1251: Authorization Bypass Through User-Controlled Key
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'addreply' function due to missing validation on a user controlled key. This makes it possible for authenticated...
Mustangproject 代码问题漏洞
Mustangproject is an invoice library, validator, and tooling software open-sourced by the ZUGFeRD Community. A code issue vulnerability exists in Mustangproject versions prior to 2.16.3 that stems from allowing file theft via XXE attacks...
