CVE-2026-45087

Dalfox (server mode) prior to v2.13.0 is vulnerable to unauthenticated remote code execution. When running dalfox server with default 0.0.0.0:6664 and no API key, POST /scan deserializes attacker-controlled options (FoundAction and FoundActionShell) into scan config, then shell commands are execu...

CVE-2026-45087: External Control of System or Configuration Setting

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

Dalfox Found-Action Deserialization RCE

When dalfox version use exploit/linux/http/dalfox/serverrcecve202645087 msf undefinedserverrcecve202645087 show actions ...actions... msf undefinedserverrcecve202645087 set ACTION msf undefinedserverrcecve202645087 show options ...show and set options... msf undefinedserverrcecve202645087 run Thi...