Lucene search
+L

290 matches found

Kitploit
Kitploit
added 2026/09/12 12:35 p.m.3 views

cli

CloudGraph — это бесплатный универсальный инструмент с открытым исходным кодом для GraphQL API и управления положением безопасности в облаке CSPM для AWS, Azure, GCP и K8s. С CloudGraph вы получаете: Бесплатные и простые проверки соответствия например, Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, A...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/12 10:00 a.m.67 views

hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

5.7AI score
SaveExploits0References10
Kitploit
Kitploit
added 2026/09/12 8:36 a.m.4 views

CVE-2025-56643

CVE-2025-56643 Общедоступная ссылка на CVE-2025-56643 – Уязвимость сессии JWT в Wiki.js 2.5.307 Описание: Requarks Wiki.js 2.5.307 не выполняет надлежащий отзыв или аннулирование активных JWT-токенов при выходе пользователя из системы. В результате ранее выданные токены остаются действительными и...

9.1CVSS8.1AI score0.00359EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 6:58 a.m.5 views

GraphQLer

The only dependency-aware GraphQL API testing tool! GraphQLer is a cutting-edge tool designed to dynamically test GraphQL APIs with a focus on adaptability. It offers a range of sophisticated features that streamline the testing process and ensure robust analysis of GraphQL APIs. GraphQLer...

5.8AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/11 9:27 p.m.4 views

CVE-2024-37843-POC

CVE-2024-37843-POC CVE-2024-37843 的 POC。Craft CMS 基于时间盲注 SQL 注入 详情见博客 POC root@kitploit: curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN assets assets ON assets.id =...

9.8CVSS6AI score0.53242EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 6:01 p.m.7 views

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Nuclei 템플릿 CVE-2026-19478 에 대한 비파괴적 Nuclei 탐지 템플릿입니다. 이 취약점은 GitLab GraphQL API의 인증되지 않은 임의 메서드 호출 결함으로, 심각도CVSS 9.4 등급이며 GitLab에서 2026년 8월 17일 에 패치했습니다. TL;DR GitLab의 GraphQL 스키마는 필드를 특정 최소 GitLab 버전으로 제한하는 @glintroducedversion: "X.Y.Z" 디렉티브를 지원합니다. 디렉티...

9.4CVSS8.3AI score0.05811EPSS
SaveExploits6References2
Kitploit
Kitploit
added 2026/09/07 2:55 p.m.7 views

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - Перечисление пользователей GitLab GitLab — это широко используемый веб-инструмент для жизненного цикла DevOps, предоставляющий менеджер Git-репозиториев со встроенными функциями непрерывной интеграции, отслеживания проблем, проверки кода и многим другим. GraphQL API — это мощный...

5.3CVSS7.2AI score0.80004EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/06 4:20 p.m.7 views

CVE-2021-4191_Exploits

CVE-2021-4191Exploits pip install python-graphql-client Использование: python3 gitlabenum.py --rurl http://10.0.0.6/api/graphql Авторские права: https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/...

5.3CVSS7.2AI score0.80004EPSS
SaveExploits4References1
NVD
NVD
added 2026/09/05 11:16 a.m.7 views

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

5.3CVSS0.00199EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/05 11:01 a.m.5 views

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

5.3CVSS5.8AI score
SaveExploits0References7
CVE
CVE
added 2026/09/05 11:01 a.m.22 views

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

5.3CVSS5.3AI score0.00199EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/05 11:01 a.m.4 views

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

7.1CVSS5.8AI score
SaveExploits0References9
CVE
CVE
added 2026/09/05 11:01 a.m.32 views

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...

7.1CVSS5.3AI score0.00263EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/09/05 11:01 a.m.36 views

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

7.1CVSS0.00263EPSS
SaveExploits0References7
CVE
CVE
added 2026/08/27 6:54 p.m.205 views

CVE-2026-18885

CVE-2026-18885 is a code injection vulnerability in the ServiceNow AI platform , specifically in its GraphQL Composite Data API , enabling an unauthenticated attacker to execute arbitrary code and access or modify instance data. The CVSS 4.0 base score is 10.0 (Critical) with all impact dimension...

10CVSS6AI score0.00426EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:54 p.m.81 views

CVE-2026-18885 Unauthenticated Remote Code Execution in GraphQL Composite Data API

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...

10CVSS0.00426EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/20 10:17 p.m.19 views

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS0.00193EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 9:36 p.m.22 views

EUVD-2026-63683

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS5.3AI score0.00193EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/20 9:36 p.m.33 views

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS0.00193EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 9:36 p.m.21 views

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS5.5AI score
SaveExploits0References5
Rows per page
Query Builder